Install pdfalyzer with Homebrew, Nix

Project links

• Homepage
• Package manager page

Commands and aliases

• combine_pdfs
• extract_pdf_pages
• extract_pdf_text
• pdfalyze
• pdfalyzer_install_pdf_parser

Project history

The Pdfalyzer was created as a Python toolkit for inspecting the logical, tree-like object structure inside PDF documents and finding suspicious content embedded in binary streams.

The project grew to include PDF-specific YARA scanning, stream decoding through Yaralyzer, font inspection, page and text extraction, and a library interface.

Adoption history

The project is available through Python packaging and Homebrew, while the input record also identifies a Nix package. Its preferred end-user installation method is pipx.

Its adoption niche is security research and suspicious-document triage: it visualizes PDF object relationships and applies PDF-specific YARA rules without executing embedded JavaScript or OpenAction entries.

How it is used

Run `pdfalyze FILE` for the standard analysis set; request stream output when byte-pattern hunting is needed, noting that this mode can be extremely verbose.

Place a `.pdfalyzer` file in the current directory for project-specific options or in the user's home directory for user defaults. The current-directory file takes precedence.

Use the optional extraction installation extras when encrypted documents, image-assisted text extraction, or the bundled extraction commands are required.

Why package nerds care

Pdfalyzer combines several familiar open-source components—pypdf, anytree, Rich, and YARA—into an opinionated forensic CLI. Package users receive both the main analyzer and small utilities for combining PDFs and extracting pages or text.

Its colorful tree visualization and rule-assisted stream inspection occupy a narrower security-analysis niche than general PDF renderers, editors, or conversion tools.

Timeline

• 2022: The project's early public documentation framed it around malicious-PDF analysis and gaps in existing PDF inspection tools.
• The toolkit subsequently expanded its analyzer, bundled rules, extraction commands, tests, and configurable runtime behavior.

Related projects

• Yaralyzer performs the project's detailed byte-pattern extraction, while YARA supplies its detection-rule model. The README also documents using Didier Stevens's PDF tools as a cross-check during malicious-PDF investigations.

Sources

• https://github.com/michelcrypt4d4mus/pdfalyzer