
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
pylddwrap
Advanced tools
.. image:: https://github.com/Parquery/pylddwrap/actions/workflows/ci.yml/badge.svg?branch=master :target: https://github.com/Parquery/pylddwrap/actions/workflows/ci.yml?query=branch%3Amaster :alt: Build Status
.. image:: https://coveralls.io/repos/github/Parquery/pylddwrap/badge.svg?branch=master :target: https://coveralls.io/github/Parquery/pylddwrap?branch=master :alt: Coverage
.. image:: https://badges.frapsoft.com/os/mit/mit.png?v=103 :target: https://opensource.org/licenses/mit-license.php :alt: MIT License
.. image:: https://badge.fury.io/py/pylddwrap.svg :target: https://badge.fury.io/py/pylddwrap :alt: PyPI - version
.. image:: https://img.shields.io/pypi/pyversions/pylddwrap.svg :alt: PyPI - Python Version
.. image:: https://readthedocs.org/projects/pylddwrap/badge/?version=latest :target: https://pylddwrap.readthedocs.io/en/latest/?badge=latest :alt: Documentation Status
Pylddwrap wraps ldd *nix utility to determine shared libraries required by a program.
We need to dynamically package subset of our system at deployment time. Consequently, we have to determine the dependencies on shared libraries of our binaries programmatically.
The output of ldd Linux command, while informative, is not structured enough to be easily integrated into a program.
At the time of this writing, we only found two alternative ldd wrappers on Internet
python-ldd <https://github.com/relip/python-ldd>_ and ldd.py <https://gist.github.com/masami256/1588876>_, but their
output was either too basic for our use case or the project was still incipient.
Pylddwrap, in contrast, returns a well-structured list of the dependencies. The command-line tool outputs the dependencies either as a table (for visual inspection) or as a JSON-formatted string (for use with other tools). The included Python module lddwrap returns a Python object with type annotations so that it can be used readily by the deployment scripts and other modules.
For more information on the ldd tool, please see ldd manual <http://man7.org/linux/man-pages/man1/ldd.1.html>_.
.. code-block:: bash
pylddwrap /bin/ls
.. code-block:: text
soname | path | found | mem_address | unused
----------------+---------------------------------------+-------+--------------------+-------
linux-vdso.so.1 | None | True | 0x00007ffd8750f000 | False
libselinux.so.1 | /lib/x86_64-linux-gnu/libselinux.so.1 | True | 0x00007f4e73dc3000 | True
libc.so.6 | /lib/x86_64-linux-gnu/libc.so.6 | True | 0x00007f4e739f9000 | False
libpcre.so.3 | /lib/x86_64-linux-gnu/libpcre.so.3 | True | 0x00007f4e73789000 | False
libdl.so.2 | /lib/x86_64-linux-gnu/libdl.so.2 | True | 0x00007f4e73585000 | False
None | /lib64/ld-linux-x86-64.so.2 | True | 0x00007f4e73fe5000 | False
libpthread.so.0 | /lib/x86_64-linux-gnu/libpthread.so.0 | True | 0x00007f4e73368000 | False
.. code-block:: bash
pylddwrap --format json /bin/ls
.. code-block:: text
[ { "soname": "linux-vdso.so.1", "path": "None", "found": true, "mem_address": "0x00007ffed857f000", "unused": false }, ... ]
--sorted which will sort by soname:.. code-block:: bash
pylddwrap /bin/pwd --sorted
soname:.. code-block:: text
soname | path | found | mem_address | unused
----------------+---------------------------------+-------+--------------------+-------
None | /lib64/ld-linux-x86-64.so.2 | True | 0x00007fd54894d000 | False
libc.so.6 | /lib/x86_64-linux-gnu/libc.so.6 | True | 0x00007fd548353000 | False
linux-vdso.so.1 | None | True | 0x00007ffe0953f000 | False
Alternatively, you can sort by any other column. For example, to sort
by path:
.. code-block:: bash
pylddwrap /bin/pwd --sorted path
.. code-block:: text
soname | path | found | mem_address | unused
----------------+---------------------------------+-------+--------------------+-------
linux-vdso.so.1 | None | True | 0x00007ffe0953f000 | False
libc.so.6 | /lib/x86_64-linux-gnu/libc.so.6 | True | 0x00007fd548353000 | False
None | /lib64/ld-linux-x86-64.so.2 | True | 0x00007fd54894d000 | False
We provide lddwrap Python module which you can integrate into your deployment scripts and other modules.
.. code-block:: python
import pathlib
import lddwrap
path = pathlib.Path("/bin/ls")
deps = lddwrap.list_dependencies(path=path)
for dep in deps:
print(dep)
"""
soname: linux-vdso.so.1, path: None, found: True, mem_address: (0x00007ffe8e2fb000), unused: None
soname: libselinux.so.1, path: /lib/x86_64-linux-gnu/libselinux.so.1, found: True, mem_address: (0x00007f7759ccc000), unused: None
soname: libc.so.6, path: /lib/x86_64-linux-gnu/libc.so.6, found: True, mem_address: (0x00007f7759902000), unused: None
...
"""
.. code-block:: python
import pathlib
import lddwrap
path = pathlib.Path("/bin/ls")
deps = lddwrap.list_dependencies(path=path, unused=True)
print(deps[1])
# soname: libselinux.so.1,
# path: /lib/x86_64-linux-gnu/libselinux.so.1,
# found: True,
# mem_address: (0x00007f5a6064a000),
# unused: True
.. code-block:: python
import os
import pathlib
import lddwrap
env = os.environ.copy()
env['LD_LIBRARY_PATH'] = "some/important/path"
path = pathlib.Path("/bin/ls")
deps = lddwrap.list_dependencies(path=path, env=env)
.. code-block:: bash
pip3 install pylddwrap
Check out the repository.
In the repository root, create the virtual environment:
.. code-block:: bash
python3 -m venv venv3
.. code-block:: bash
source venv3/bin/activate
.. code-block:: bash
pip3 install -e .[dev]
unittest:.. code-block:: bash
python3 -m unittest discover tests/
We provide a set of pre-commit checks that lint and check code for formatting.
Namely, we use:
yapf <https://github.com/google/yapf>_ to check the formatting.pydocstyle <https://github.com/PyCQA/pydocstyle>_.mypy <http://mypy-lang.org/>_.pylint <https://www.pylint.org/>_.Apply the automatic formatting by running the format environment:
.. code-block:: bash
tox -e format
Run the pre-commit checks and tests using tox:
.. code-block:: bash
tox
We follow Semantic Versioning <http://semver.org/spec/v1.0.0.html>_. The version X.Y.Z indicates:
FAQs
Wrap ldd *nix utility to determine shared libraries required by a program.
We found that pylddwrap demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.