yara-python

library4.5.4pypypi✓ verified 21d ago

yara-python is the official Python interface for YARA, a pattern matching tool used by security researchers to identify and classify malware. It provides bindings to the YARA C library, allowing Python applications to compile and apply YARA rules. The library is actively maintained, with new versions (currently 4.5.4) typically released in conjunction with updates to the underlying YARA engine.

auth-security devops

pip install yara-python

github ↗package ↗

INSTALL

IMPORT

SIG · YARA-PYTHON

yara-python

auth-securitypythonv4.5.4

Install

1.6s avg

Import

—

Disk

22MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v4.5.4 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 24.2MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 1.6s · import 0.000s · 24MB

22MB installed

● package 22MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

yara

✓ import yara

This quickstart demonstrates how to compile a simple YARA rule from a string and then apply it to scan binary data. It shows how to access the matched rule's name, tags, and details about the matched strings, including their identifiers, offsets, and data.

import yara # Compile a YARA rule from a string rules = yara.compile(source='rule foo: bar { strings: $a = "lmn" condition: $a }') # Scan some data data_to_scan = b'abcdefgjiklmnoprstuvwxyz' matches = rules.match(data=data_to_scan) # Process matches if matches: for match in matches: print(f"Rule: {match.rule}, Tags: {match.tags}") # In YARA-Python 4.3.0+, match.strings is a list of yara.StringMatch objects for s in match.strings: print(f" String: {s.identifier} at offset {s.instances[0].offset} with data '{s.instances[0].matched_data.decode()}'") else: print("No matches found.")

yara --version

Debug

Known issues

breakingThe structure of the `yara.Match.strings` field changed in version 4.3.0. Previously, it was a list of tuples `(<offset>, <string identifier>, <string data>)`. It is now a list of `yara.StringMatch` objects, which in turn contain `yara.StringMatchInstance` objects for actual matches.

fix

Update code iterating over `match.strings`. Instead of direct tuple unpacking, access attributes like `s.identifier`, `s.instances[0].offset`, and `s.instances[0].matched_data` on the `yara.StringMatch` and `yara.StringMatchInstance` objects.

affects: >=4.3.0

gotchaOn Linux and macOS, `pip install yara-python` may fail unless the YARA C library and its development headers are pre-installed via the system's package manager. This is because `yara-python` is a wrapper around the C library and often needs to compile against it if a pre-built wheel is not available for your specific platform/Python version.

fix

Before `pip install yara-python`, install YARA and its development packages (e.g., `libyara-dev`, `python3-dev`, `gcc` on Debian/Ubuntu, or `yara` via Homebrew on macOS).

affects: All versions

gotchaVersions 4.3.x had a memory leak and potential heap corruption issue related to incorrect reference counting when calling `yara.StringMatchInstance.plaintext()` without an XOR key. This was fixed in YARA-Python 4.4.0.

fix

Upgrade to `yara-python` version 4.4.0 or later to ensure memory stability when working with `StringMatchInstance` objects.

affects: 4.3.0 - 4.3.1

gotchaThere's a distinction between `yara.compile()` and `yara.load()`. `yara.compile()` processes YARA rule source code (from strings, files, or file paths). `yara.load()` is used to load *pre-compiled* YARA rule files (typically with a `.yarac` extension) that have been previously saved using `rules.save()`.

fix

Use `yara.compile()` for human-readable rule files (.yara, .yar) or rule strings, and `yara.load()` only for binary pre-compiled rule files. Using `load()` on a text rule file will result in an error.

affects: All versions

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'yara'

The yara-python package has not been installed in the active Python environment.

fix

Install the package using `pip install yara-python`.

yara.Error: could not find yara library

The yara-python library cannot find or load the underlying YARA C library at runtime.

fix

Ensure the YARA C library (e.g., `yara.dll` on Windows, `libyara.so` on Linux) is correctly installed and discoverable in your system's PATH, or specify its location using the `YARA_DLL_PATH` environment variable on Windows.

fatal error: yara/libyara.h: No such file or directory

During installation, the C compiler cannot find the YARA development headers required to build the yara-python extension module.

fix

Install the YARA development package for your operating system (e.g., `sudo apt-get install libyara-dev` on Debian/Ubuntu, `brew install yara` on macOS, or build YARA from source).

yara.Error: syntax error at line X: ...

The YARA rule string or file provided to `yara.compile()` contains one or more syntax errors.

fix

Carefully review the YARA rule's syntax, ensuring it adheres to the YARA grammar and correcting any malformed expressions or keywords.

Upgrade

Version history

4.5.4latest on PyPI · released May 27, 2025

Audit

Dependencies

No dependency data recorded yet.

Agent activity

37 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/VirusTotal/yara-python ↗

packagehttps://pypi.org/project/yara-python/ ↗