About

Atomdrift is quietly building the next-generation of open-source malware and supply-chain attack detection tools. Our mission is to build offline local-first tools that excel at detecting even subtle supply-chain attacks such as the XZ Utils backdoor.

With Atomdrift Scan, we already offer better malware detection than any OSS or commercial offering. We're not stopping there though. Everything is Apache 2.0, designed for integration into any pipeline or product, supporting any platform you might need to secure: from MacBooks to Windows PCs to IBM mainframes.

News

• 2026-09-08 Scan v2.9.0 & Beamline: now shipping a real HTTP API Introducing support for real HTTP APIs using Beamline and Scan
• 2026-08-14 cleave & Scan v2.7.1, isomer v0.4.0 CPU work, mostly. cleave is about 25% faster; Scan and isomer embed it, so they are too. Four file-type rules that never ran now run. isomer v0.4.0 adds three detectors that need no rules.

All news →

Projects

• scan stable
  Local malware scanner. Runs azoth and other open models over capabilities extracted by cleave, across binaries, scripts, source, packages, and archives.
• azoth stable
  Open model bundle for malware detection. A routed ensemble over cleave's capabilities, covering more than 100 file and container types. Runs on CPU.
• cleave stable
  Static analysis and capability extraction for source, binaries, bytecode, packages, archives, documents, and deployment configuration.
• stng stable
  String extraction for binary analysis that keeps the signal and drops the noise. Used for triage, C2 enumeration, credential extraction, and signature development.
• filefacts stable
  Rust library that reads a file once and returns ML-ready facts: package identity, binary provenance, source AST features, strings, symbols, metrics, and structured errors.
• isomer experimental
  Differential analyzer that judges whether the change between two versions is malicious. Built for subtle attacks like xz-utils. In heavy development.
• hood experimental
  Local gate for software fetched by developers and AI agents. Scans public and private artifacts before they reach a package manager, installer, or curl | sh, without changing your workflow.