{"id":24221,"library":"pdfid","title":"PDFiD","description":"A Python library based on DidierStevens' PDFID tool for analyzing PDF files for malicious content. It scans PDFs for common suspicious elements like JavaScript, embedded files, and auto-actions. Current version 1.1.3, with intermittent releases.","status":"active","version":"1.1.3","language":"python","source_language":"en","source_url":"https://github.com/mlodic/pdfid","tags":["pdf","malware-analysis","forensics","security"],"install":[{"cmd":"pip install pdfid","lang":"bash","label":"Install from PyPI"}],"dependencies":[{"reason":"Required for parsing some PDF structures","package":"pyewf","optional":true}],"imports":[{"note":"PDFiD is the main class; importing pdfid directly does not expose it.","wrong":"import pdfid","symbol":"PDFiD","correct":"from pdfid import PDFiD"},{"note":"Module is pdfid, not a package hierarchy.","wrong":"from pdfid.PDFiD2JSON import PDFiD2JSON","symbol":"PDFiD2JSON","correct":"from pdfid import PDFiD2JSON"}],"quickstart":{"code":"from pdfid import PDFiD\n\n# Analyze a PDF file\nwith open('sample.pdf', 'rb') as f:\n    data = f.read()\n\npdfid = PDFiD(data)\nprint(pdfid.results())","lang":"python","description":"Instantiate PDFiD with file content as bytes, then call results() for a dictionary of findings."},"warnings":[{"fix":"Open the file in binary mode and read all bytes before passing to PDFiD.","message":"PDFiD expects the entire file content as bytes; passing a file path or file object will fail silently or raise an error.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Check counts > 0 to determine presence: if pdfid.results().get('JavaScript', 0) > 0.","message":"The results() method returns a dictionary with keys like 'JavaScript', 'OpenAction', etc. The values are the count of occurrences, not booleans.","severity":"gotcha","affected_versions":">=1.0.0"}],"env_vars":null,"last_verified":"2026-05-01T00:00:00.000Z","next_check":"2026-07-30T00:00:00.000Z","problems":[{"fix":"Use: from pdfid import PDFiD","cause":"Incorrect import: importing pdfid as a whole instead of the class.","error":"AttributeError: module 'pdfid' has no attribute 'PDFiD'"},{"fix":"Read file content first: with open('file.pdf', 'rb') as f: data = f.read() ; pdfid = PDFiD(data)","cause":"PDFiD does not accept a file path; it requires bytes content.","error":"TypeError: initializer got an unexpected keyword argument 'path'"}],"ecosystem":"pypi","meta_description":null,"install_score":null,"install_tag":null,"quickstart_score":null,"quickstart_tag":null}