vipyrsec / dragonfly

A combined C2 and malware scanning service focused on the early identification, analysis, and reporting of malicious packages on the Python Package Index
MIT License
0 stars 0 forks source link

Calculate YARA weight per-package not per-file #15

Closed import-pandas-as-numpy closed 1 year ago

import-pandas-as-numpy commented 1 year ago

A package could make gratuitous use of tempfiles and not be malicious itself, but each instance of this would increase its score. This means I cannot reasonably adjust the weighting for tempfile to a point where it will no longer trigger false positives.