PthGuard Python backdoor scanner
Helps you find malicious .pth startup files and tampered packages in a Python environment, a trick some compromised PyPI packages use to run code when the interpreter starts. PthGuard is a single-file Python tool, standard library only, that inspects files without executing them. It flags risky patterns such as exec(), base64 decoding and subprocess calls in .pth, sitecustomize.py and usercustomize.py files, checks installed files against the SHA-256 hashes in their RECORD, and matches packages against a known-bad list you can extend with JSON. --demo runs an offline self-test. Example: python -I -S pthguard_python_backdoor_scann.py /usr/lib/python3.11/site-packages Main limit: static checks only; it does not delete or clean files, but --quarantine-script writes the commands for you to review.
Quick Start
Runs on Python 3.9 or newer with the standard library only. Nothing to pip install.
1 — Run it
python pthguard_python_backdoor_scann.py --helpHow agents & programs use it: It uses only the Python standard library, so scripts and AI agents can run it as a subprocess without extra installs.
All-Access Pass
Get every PyForge tool with the All-Access Pass
28 tools today plus every future release, lifetime commercial license, one payment of $99.
This tool: $39 · All 28 tools: $99
See the All-Access Pass