yara-python is the official Python interface for YARA, a pattern matching tool used by security researchers to identify and classify malware. It provides bindings to the YARA C library, allowing Python applications to compile and apply YARA rules. The library is actively maintained, with new versions (currently 4.5.4) typically released in conjunction with updates to the underlying YARA engine.
Install & Compatibility
Where this runs
tested against v4.5.4 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 24.2MB
glibcpy 3.10–3.920 runs
installs and imports cleanly · install 1.7s · import 0.000s · 24MB
22MB installed
● package 22MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to compile a simple YARA rule from a string and then apply it to scan binary data. It shows how to access the matched rule's name, tags, and details about the matched strings, including their identifiers, offsets, and data.
import yara
# Compile a YARA rule from a string
rules = yara.compile(source='rule foo: bar { strings: $a = "lmn" condition: $a }')
# Scan some data
data_to_scan = b'abcdefgjiklmnoprstuvwxyz'
matches = rules.match(data=data_to_scan)
# Process matches
if matches:
for match in matches:
print(f"Rule: {match.rule}, Tags: {match.tags}")
# In YARA-Python 4.3.0+, match.strings is a list of yara.StringMatch objects
for s in match.strings:
print(f" String: {s.identifier} at offset {s.instances[0].offset} with data '{s.instances[0].matched_data.decode()}'")
else:
print("No matches found.")
yara --version
Upgrade
Version history
Breaking-change detection hasn't run for this library yet.
Audit
Security & dependencies
CVE tracking and dependency tree are planned for a later release.