Hexora – detection and analysis of malicious Python scripts

Hacker News

I made a new library to detect malicious and harmful behaviour in Python scripts. It uses static analysis with semantic modeling. Even when the code is pretty obfuscated, it can still detect it. For example, it can infer that getattr(sys.modules["built"+"ins"], "".join(reversed(["al","ev"])))("1+1") Is basically: eval("1+1"). Currently, I'm testing it on public files where some of them implement malicious behavior, as well as past malicious packages on PyPI. You can see some of the detection examples here: https://github.com/rushter/hexora/blob/main/docs/examples.md I'd love to hear your feedback and ideas on how to improve this and identify missing rules.

Visit product View on Hacker NewsAug 23, 2025

Share card

Actual performance

3points

Did not reach leaderboard

Launch Intel predictions

Analyze your own launch →

Hacker NewsStrong engagement from HN community · Strong signals: ide, io · Missing: https docs, excited, just released

52%52% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

Indie HackersIH features products with proven revenue · Missing: supports, reddit linkedin, podcasting

39%39% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

TrustMRRLess likely to generate early MRR · Missing: mobile apps, ios, personal

38%38% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

AppSumoMay struggle as an AppSumo deal · Missing: plus, platform, intuitive

36%36% predicted probability of success on AppSumo, based on ML models trained on real launch data.

Product HuntUnlikely to reach the leaderboard · Strong signals: model, new, code · Missing: mac, agents, macos

32%32% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

20%20% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Missing: web3, chat, crypto

1%1% predicted probability of success on BetaList, based on ML models trained on real launch data.

Incorrect prediction on native model

Similar products

Redis Lua scripts as typed Python functions75%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Redis Lua scripts as typed Python functions

Hacker News1

Naive Corner Detection Python Implementation56%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Naive Corner Detection Python Implementation

Hacker News1

Monte Carlo Analysis of 'Chutes and Ladders' with Python44%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Monte Carlo Analysis of 'Chutes and Ladders' with Python

Hacker News3

Hexora – static analysis tool for malicious Python scripts50%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Hexora – static analysis tool for malicious Python scripts

Hacker News2

Wolverine: Give your Python scripts regenerative healing abilities69%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Wolverine: Give your Python scripts regenerative healing abilities

Hacker News43

NixSH, run Bash/Python or any scripts with the power of Nix45%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

NixSH, run Bash/Python or any scripts with the power of Nix

Hacker News2

Wooey Web UIs for Python Scripts57%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Wooey Web UIs for Python Scripts

Hacker News1

Scripts for Trello53%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Scripts for Trello

Hacker News19

mruby-rake, compile your ruby scripts to mruby executable56%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

mruby-rake, compile your ruby scripts to mruby executable

Hacker News3

I made a compiler/VM for untrusted scripts59%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

I made a compiler/VM for untrusted scripts

Hacker News2

Browse all products Analyze your launch