# yara-x mit Homebrew, Nix, scoop, winget installieren Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für yara-x in AI-Agent-Workflows. ## Installation ```sh sudo av install brew:yara-x ``` Weitere Installationsbefehle: ### macOS - Homebrew (100%): ```sh brew install yara-x ``` Evidenz: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#yara-x ``` Evidenz: nixpkgs package indexes: pkgs/by-name/ya/yara-x/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ### Windows - Scoop (92%): ```sh scoop install main/yara-x ``` Evidenz: Scoop official bucket manifest trees: bucket/yara-x.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 - winget (92%): ```sh winget install --id VirusTotal.YARA-X -e ``` Evidenz: Windows Package Manager source index: VirusTotal.YARA-X from https://cdn.winget.microsoft.com/cache/source.msix ## Paketfakten - **Paketschlüssel:** brew:yara-x - **Paketmanager:** Homebrew - **Paketmanager-Seite:** - **Version:** 1.19.0 - **Quellzusammenfassung:** Tool to do pattern matching for malware research - **Homepage:** - **Repository:** - **Upstream-Dokumentation:** - **Lizenz:** BSD-3-Clause - **Quellarchiv:** - **Zuletzt aktualisiert:** 2026-06-24T17:31:08Z - **Generiert:** 2026-08-04T22:13:35+00:00 ## Executables - yr (cli) - yr (Alias) ## Build-Abhängigkeiten - cargo-c - rust ## Installationsverhalten - Post-install-Hook: nicht definiert - Bottle: verfügbar auf arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Version und Aktualität - Seite generiert: 2026-08-04 - Manager-Version: 1.19.0 - Manager aktualisiert: 2026-06-24 - lokale Daten: OK - Upstream-Repository: https://github.com/VirusTotal/yara-x - neueste erkannte Version: v1.19.0 (aktuell) ## Projektgeschichte und Nutzung YARA-X is VirusTotal's Rust rewrite and intended successor to YARA, the rule-based pattern-matching tool used heavily in malware research. It keeps YARA's rule-language lineage while aiming for better safety, performance, user-friendliness, and modern library APIs. ### Projektgeschichte The yara-x repository was created on 2022-10-14. Upstream describes YARA-X as a re-incarnation of YARA whose ultimate goal is to replace YARA as the default pattern-matching tool for malware researchers. The rewrite also moves the implementation from C into Rust while exposing C/C++, Python, Go, and Rust APIs. Victor M. Alvarez's 2024 post 'YARA is dead, long live YARA-X' explained the transition without actually abandoning YARA: YARA would continue to receive bug fixes and minor features, while major new modules and enhancements would focus on YARA-X. VirusTotal had already been running the new engine alongside YARA and comparing results at large scale. YARA-X reached its public stability milestone with v1.0.0 on 2025-06-04. The accompanying YARA-X blog post says the release ended the beta phase and that the original YARA project entered maintenance mode, with future innovation happening in YARA-X. ### Adoptionsgeschichte The most important adoption signal came from VirusTotal itself. In December 2024, VirusTotal announced that YARA-X had replaced YARA as the engine powering Livehunt and Retrohunt, two production services where rule compatibility and scale matter more than novelty. Adoption is intentionally migration-shaped rather than greenfield. The docs emphasize high rule compatibility, explain the differences with YARA, and encourage existing YARA users to explore YARA-X without requiring a rushed cutover. ### Wie es verwendet wird The packaged CLI is `yr`. Users write familiar YARA-style rules with patterns and conditions, then scan files or integrate the engine through language bindings. YARA-X also adds modern tooling around the rule lifecycle, including formatting, checking, warnings, a configuration file for some commands, and a language server. Practical usage today is split between command-line malware hunting, CI-style rule validation, and embedding YARA-compatible matching in security products or research pipelines that benefit from Rust's safety and newer APIs. ### Warum Paket-Nerds sich dafür interessieren YARA-X is package-nerd significant because it is a rare live succession story for a security standard tool: not a fork competing with the old package, but the same steward moving a widely packaged C utility toward a Rust implementation while preserving rule compatibility. It also changes the shape of the package from a classic CLI/library pair into a broader toolchain: formatter, checker, language server, multi-language APIs, and a migration target for years of existing YARA rules. ### Zeitleiste - 2022-10-14: VirusTotal/yara-x repository is created. - 2024-02-21: VirusTotal publishes 'YARA is dead, long live YARA-X', describing YARA-X as the future development focus. - 2024-12-04: VirusTotal announces YARA-X powers Livehunt and Retrohunt. - 2025-06-04: YARA-X 1.0.0 is released as the first stable release. - 2026-06-24: YARA-X v1.19.0 is published in GitHub releases. ### Related projects - YARA is the original C implementation and rule-language predecessor now in maintenance mode. - yara-python is the long-standing Python binding for classic YARA; YARA-X provides its own Python API. - VirusTotal Livehunt and Retrohunt are production services that moved to YARA-X. ### Quellen - - - - - - - - ## Sicherheitshinweise narrow executable package without higher-risk signals. - **Geiger-Risiko:** grün / niedrig - narrow executable package without higher-risk signals ## Details aus der Quelldatenbank - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** yara-x - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Andere Paketmanager-Einträge - Nix - yara-x: normalized package name match | nixpkgs package indexes: pkgs/by-name/ya/yara-x/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Scoop - main/yara-x: normalized package name match | Scoop official bucket manifest trees: bucket/yara-x.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 - winget - VirusTotal.YARA-X: normalized package name match | Windows Package Manager source index: VirusTotal.YARA-X from https://cdn.winget.microsoft.com/cache/source.msix ## Verwandte Links - [Source-control packages](https://pkg.so/de/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://pkg.so/de/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Language runtime packages](https://pkg.so/de/language-runtime-packages/) - Matched language runtime, compiler, or interpreter metadata. - [Networking and protocol packages](https://pkg.so/de/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [rust](https://pkg.so/de/brew/rust/) - Build dependency declared by Homebrew. - [cargo-c](https://pkg.so/de/brew/cargo-c/) - Build dependency declared by Homebrew. - [malcontent](https://pkg.so/de/brew/malcontent/) - Popular package that depends on this formula. - [yara](https://pkg.so/de/brew/yara/) - Shares pkgdb curated category or tags: cli, malware, pattern-matching, rules, security. - [rustscan](https://pkg.so/de/brew/rustscan/) - Shares pkgdb curated category or tags: cli, rust, security. - [jwt-cli](https://pkg.so/de/brew/jwt-cli/) - Shares pkgdb curated category or tags: cli, rust, security. - [cargo-audit](https://pkg.so/de/brew/cargo-audit/) - Shares pkgdb curated category or tags: cli, rust, security. - [cargo-deny](https://pkg.so/de/brew/cargo-deny/) - Shares pkgdb curated category or tags: cli, rust, security. - [feluda](https://pkg.so/de/brew/feluda/) - Shares pkgdb curated category or tags: cli, rust, security. - [cargo-geiger](https://pkg.so/de/brew/cargo-geiger/) - Shares pkgdb curated category or tags: cli, rust, security. - [observerward](https://pkg.so/de/brew/observerward/) - Shares pkgdb curated category or tags: cli, rust, security. - [virustotal-cli](https://pkg.so/de/brew/virustotal-cli/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, malware, security. - [authoscope](https://pkg.so/de/brew/authoscope/) - Both packages touch the same language runtime or ecosystem. Shared terms: cli, rust, security. ## Combined YAML source View the package source record on GitHub. [combined/yara-x.yml](https://github.com/mxcl/pkgdb/blob/main/combined/yara-x.yml) ## Quellen - pkg.so package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph