
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
mathparse
Advanced tools
A secure, multilingual mathematical expression evaluator for Python
mathparse is a Python library that safely parses and evaluates mathematical expressions from strings, supporting both numeric operators and natural language words across 13+ languages. Unlike Python's dangerous eval() function, mathparse provides a secure, zero-dependency solution for evaluating user-provided mathematical expressions.
✅ Security First - Never uses eval(), protecting against arbitrary code execution
✅ Multilingual Support - Parse math in English, Spanish, French, German, Chinese, and 8+ more languages
✅ Zero Dependencies - Pure Python implementation with no external requirements
✅ Natural Language - Understands "fifty times twenty plus ten" alongside standard notation
✅ Production Ready - Used in chatbots, calculators, voice assistants, and educational applications
✅ Well Tested - Comprehensive test suite ensuring reliability
from mathparse import mathparse
# Standard numeric expressions
mathparse.parse('50 * (85 / 100)')
>>> 42.5
# Natural language in English
mathparse.parse('one hundred times fifty four', language='ENG')
>>> 5400
# Mixed notation
mathparse.parse('(seven * nine) + 8 - (45 plus two)', language='ENG')
>>> 24
# Other languages (French, Spanish, German, Chinese, etc.)
mathparse.parse('cinq plus trois', language='FRE')
>>> 8
mathparse.parse('cinco más tres', language='ESP')
>>> 8
eval() calls with safe parsingPython's eval() function executes arbitrary code, creating severe security vulnerabilities:
# DANGEROUS - Never do this with user input!
eval("__import__('os').system('rm -rf /')") # Deletes files
eval("__import__('requests').get('evil.com')") # Network access
mathparse is the safe alternative:
| Feature | eval() | mathparse |
|---|---|---|
| Mathematical expressions | ✅ | ✅ |
| Arbitrary code execution | ⚠️ YES - DANGEROUS | ❌ No |
| File system access | ⚠️ YES - DANGEROUS | ❌ No |
| Network access | ⚠️ YES - DANGEROUS | ❌ No |
| Import statements | ⚠️ YES - DANGEROUS | ❌ No |
| Security risk | 🔴 CRITICAL | 🟢 Safe |
| Dependencies | 0 | 0 |
| Natural language support | ❌ No | ✅ Yes |
| Multilingual | ❌ No | ✅ 13+ languages |
mathparse uses postfix (Reverse Polish) notation internally, ensuring only valid mathematical operations are performed. See our security documentation for technical details.
The language parameter must be set in order to evaluate an equation that uses word operators. The language code should be a valid ISO 639-2 language code.
pip install mathparse
See the full documentation at https://mathparse.chatterbot.us
See release notes for changes.
FAQs
mathparse is a library for solving mathematical equations contained in strings
We found that mathparse demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.