A Python library based on DidierStevens' PDFID tool for analyzing PDF files for malicious content. It scans PDFs for common suspicious elements like JavaScript, embedded files, and auto-actions. Current version 1.1.3, with intermittent releases.
pip install pdfidVerified import paths — ran on the pinned version, not inferred.
Instantiate PDFiD with file content as bytes, then call results() for a dictionary of findings.
Open the file in binary mode and read all bytes before passing to PDFiD.
Check counts > 0 to determine presence: if pdfid.results().get('JavaScript', 0) > 0.