File size: 1,795 Bytes
07d6f24
 
 
1d66f22
07d6f24
1d66f22
07d6f24
 
1d66f22
 
 
07d6f24
1d66f22
07d6f24
1d66f22
07d6f24
1d66f22
07d6f24
1d66f22
07d6f24
1d66f22
07d6f24
1d66f22
07d6f24
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
---
license: mit
---
<div align="center">

# malwi - AI Python Malware Scanner
<img src="malwi-logo.png" alt="Logo">

<a href='https://huggingface.co/schirrmacher/malwi'><img src='https://img.shields.io/badge/%F0%9F%A4%97%20HF-Model-blue'></a>

</div>

## Key Features

- πŸ›‘οΈ **AI-Powered Python Malware Detection**

- ⚑ **Lightning-Fast Codebase Scanning**

- πŸ”’ **100% Offline & Private**

- πŸ’° **Free & Open-Source**

- πŸ‡ͺπŸ‡Ί **Developed in the EU**

### 1) Install
```
pip install --user malwi
```

### 2) Run
```bash
malwi scan examples/malicious
```

### 3) Evaluate: a [recent zero-day](https://socket.dev/blog/malicious-pypi-package-targets-discord-developers-with-RAT) detected with high confidence
```
                  __          __
  .--------.---.-|  .--.--.--|__|
  |        |  _  |  |  |  |  |  |
  |__|__|__|___._|__|________|__|
     AI Python Malware Scanner


- target: examples
- seconds: 1.87
- files: 14
  β”œβ”€β”€ scanned: 4 (.py)
  β”œβ”€β”€ skipped: 10 (.cfg, .md, .toml, .txt)
  └── suspicious:
      β”œβ”€β”€ examples/malicious/discordpydebug-0.0.4/setup.py
      β”‚   └── <module>
      β”‚       β”œβ”€β”€ archive compression
      β”‚       └── package installation execution
      └── examples/malicious/discordpydebug-0.0.4/src/discordpydebug/__init__.py
          β”œβ”€β”€ <module>
          β”‚   β”œβ”€β”€ process management
          β”‚   β”œβ”€β”€ deserialization
          β”‚   β”œβ”€β”€ system interaction
          β”‚   └── user io
          β”œβ”€β”€ run
          β”‚   └── fs linking
          β”œβ”€β”€ debug
          β”‚   β”œβ”€β”€ fs linking
          β”‚   └── archive compression
          └── runcommand
              └── process management

=> πŸ‘Ή malicious 0.98
```