{"id":19710525,"url":"https://github.com/leakix/yarastream","last_synced_at":"2026-06-03T23:31:11.164Z","repository":{"id":66369308,"uuid":"602729590","full_name":"LeakIX/YaraStream","owner":"LeakIX","description":"Yara io scanning library for Golang ","archived":false,"fork":false,"pushed_at":"2023-10-17T10:32:33.000Z","size":31,"stargazers_count":2,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-02-25T10:55:09.973Z","etag":null,"topics":["leakix","redteam","security","threat-hunting","yara","yara-scanner"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/LeakIX.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-02-16T20:26:57.000Z","updated_at":"2024-04-26T10:32:12.000Z","dependencies_parsed_at":"2024-06-20T07:34:56.860Z","dependency_job_id":null,"html_url":"https://github.com/LeakIX/YaraStream","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LeakIX%2FYaraStream","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LeakIX%2FYaraStream/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LeakIX%2FYaraStream/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LeakIX%2FYaraStream/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/LeakIX","download_url":"https://codeload.github.com/LeakIX/YaraStream/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241029231,"owners_count":19896880,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["leakix","redteam","security","threat-hunting","yara","yara-scanner"],"created_at":"2024-11-11T22:07:37.636Z","updated_at":"2026-06-03T23:31:11.123Z","avatar_url":"https://github.com/LeakIX.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Yara scanner for Golang\n\nYara scanner library compatible with `io.Reader` for streaming\n\n## Features\n\n- Read multiple rules for multiple directories\n- Scan inside archives with maximum depth\n\n## Requirements\n\nAll requirements from [github.com/hillu/go-yara](https://github.com/hillu/go-yara) apply\n\n## Example\n\n```golang\npackage main\n\nimport (\n\t\"crypto/sha1\"\n\t\"crypto/sha256\"\n\t\"flag\"\n\t\"github.com/LeakIX/YaraStream\"\n\t\"io\"\n\t\"io/fs\"\n\t\"log\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"runtime\"\n\t\"sync\"\n)\n\nvar yaraScanner *YaraStream.YaraScanner\nvar fileChan = make(chan string)\nvar wg sync.WaitGroup\n\nfunc main() {\n\tvar err error\n\tflag.Parse()\n\tif len(flag.Args()) != 1 {\n\t\tlog.Fatal(\"You must provide a file to scan\")\n\t}\n\tyaraScanner, err = YaraStream.NewYaraScanner(\n\t\tYaraStream.RuleDirectory{Namespace: \"AbuseCH\", Path: \"./rules/abusech\"},\n\t\tYaraStream.RuleDirectory{Namespace: \"ReversingLabs\", Path: \"./rules/reversinglabs\"},\n\t\tYaraStream.RuleDirectory{Namespace: \"ESET\", Path: \"./rules/eset\"},\n\t\tYaraStream.RuleDirectory{Namespace: \"AlienVault\", Path: \"./rules/otx\"},\n\t)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\tfor w := 1; w \u003c= runtime.NumCPU(); w++ {\n\t\tgo worker()\n\t}\n\terr = filepath.Walk(flag.Arg(0), func(path string, info fs.FileInfo, err error) error {\n\t\tif err != nil {\n\t\t\treturn nil\n\t\t}\n\t\tif info.IsDir() || !info.Mode().IsRegular() {\n\t\t\treturn nil\n\t\t}\n\t\twg.Add(1)\n\t\tfileChan \u003c- path\n\t\treturn nil\n\t})\n\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\twg.Wait()\n}\n\nfunc worker() {\n\tfor filePath := range fileChan {\n\t\tscanFile(filePath)\n\t\twg.Done()\n\t}\n}\n\nfunc scanFile(path string) error {\n\tlog.Printf(\"Scanning %s\", path)\n\tfile, err := os.Open(path)\n\tif err != nil {\n\t\tlog.Println(err)\n\t\treturn nil\n\t}\n\tsha256Hasher := sha256.New()\n\tsha1Hasher := sha1.New()\n\tsha256Tee := io.TeeReader(file, sha256Hasher)\n\tsha1Tee := io.TeeReader(sha256Tee, sha1Hasher)\n\tmatches, err := yaraScanner.ScanReader(sha1Tee, YaraStream.WithFilenameTip(path), YaraStream.WithMaxLevel(3))\n\tfor _, scanResult := range matches {\n\t\tlog.Printf(\"[YARA] Infection found: %s/%s in %s\\n\", scanResult.Namespace(), scanResult.Identifier(), path)\n\t}\n\treturn nil\n}\n\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fleakix%2Fyarastream","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fleakix%2Fyarastream","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fleakix%2Fyarastream/lists"}