Install yara-x with Homebrew, Nix, scoop, winget

Project links

• Homepage
• Repository
• Upstream docs
• Package manager page

Commands and aliases

• yr

Project history

The yara-x repository was created on 2022-10-14. Upstream describes YARA-X as a re-incarnation of YARA whose ultimate goal is to replace YARA as the default pattern-matching tool for malware researchers. The rewrite also moves the implementation from C into Rust while exposing C/C++, Python, Go, and Rust APIs.

Victor M. Alvarez's 2024 post 'YARA is dead, long live YARA-X' explained the transition without actually abandoning YARA: YARA would continue to receive bug fixes and minor features, while major new modules and enhancements would focus on YARA-X. VirusTotal had already been running the new engine alongside YARA and comparing results at large scale.

YARA-X reached its public stability milestone with v1.0.0 on 2025-06-04. The accompanying YARA-X blog post says the release ended the beta phase and that the original YARA project entered maintenance mode, with future innovation happening in YARA-X.

Adoption history

The most important adoption signal came from VirusTotal itself. In December 2024, VirusTotal announced that YARA-X had replaced YARA as the engine powering Livehunt and Retrohunt, two production services where rule compatibility and scale matter more than novelty.

Adoption is intentionally migration-shaped rather than greenfield. The docs emphasize high rule compatibility, explain the differences with YARA, and encourage existing YARA users to explore YARA-X without requiring a rushed cutover.

How it is used

The packaged CLI is `yr`. Users write familiar YARA-style rules with patterns and conditions, then scan files or integrate the engine through language bindings. YARA-X also adds modern tooling around the rule lifecycle, including formatting, checking, warnings, a configuration file for some commands, and a language server.

Practical usage today is split between command-line malware hunting, CI-style rule validation, and embedding YARA-compatible matching in security products or research pipelines that benefit from Rust's safety and newer APIs.

Why package nerds care

YARA-X is package-nerd significant because it is a rare live succession story for a security standard tool: not a fork competing with the old package, but the same steward moving a widely packaged C utility toward a Rust implementation while preserving rule compatibility.

It also changes the shape of the package from a classic CLI/library pair into a broader toolchain: formatter, checker, language server, multi-language APIs, and a migration target for years of existing YARA rules.

Timeline

• 2022-10-14: VirusTotal/yara-x repository is created.
• 2024-02-21: VirusTotal publishes 'YARA is dead, long live YARA-X', describing YARA-X as the future development focus.
• 2024-12-04: VirusTotal announces YARA-X powers Livehunt and Retrohunt.
• 2025-06-04: YARA-X 1.0.0 is released as the first stable release.
• 2026-06-24: YARA-X v1.19.0 is published in GitHub releases.

Related projects

• YARA is the original C implementation and rule-language predecessor now in maintenance mode.
• yara-python is the long-standing Python binding for classic YARA; YARA-X provides its own Python API.
• VirusTotal Livehunt and Retrohunt are production services that moved to YARA-X.

Sources

• https://api.github.com/repos/VirusTotal/yara-x
• https://api.github.com/repos/VirusTotal/yara-x/releases?per_page=100
• https://github.com/VirusTotal/yara-x
• https://virustotal.github.io/yara-x/
• https://virustotal.github.io/yara-x/blog/virustotal-moves-to-yara-x/
• https://virustotal.github.io/yara-x/blog/yara-is-dead-long-live-yara-x/
• https://virustotal.github.io/yara-x/blog/yara-x-is-stable/
• https://virustotal.github.io/yara-x/docs/intro/getting-started/