Hexora v0.3 is a Python library for detecting malicious PyPI packages using static analysis. The new release adds a gradient boosting machine learning model that analyzes code structure, semantic features, and static analysis results to assess entire Python files. The ML model's primary role is filtering false positives — previously yielding 5-10 false positives per real finding. Running against newly published PyPI packages, it now detects 2-10 malicious packages daily. Remaining false positives mostly come from AI-related projects that use dynamic code execution, base64-inlined assets, or telemetry.
1.2K Impressions