More zero-day malware detected as hostile than VirusTotal, at the same false-positive rate — on your own hardware.

Over the last 7 days, set to L250: 61.0% of live zero-day malware detected as hostile at 0.1% false positives. VirusTotal detected 56.3%, one upload at a time. Atomdrift reads the artifact and decides at scan time; nothing leaves your machine. The shipped default, L25, is beside it.

curl -fsSL https://install.atomdrift.org/scan.sh | sh

Apache-2.0 · Linux, macOS, Windows, BSD, illumos · no telemetry

Last 7 days · 14 runs · 2026-11-11

76.1%

Zero-day malware detected

0.3%

false positives

Hostile

55.1%

0.1% false positives

Suspicious

21.1%

0.1% false positives

at L250: 61.0% hostile · 0.1% false positives

Sensitivity

L0L2000–L2500

at L25 — the shipped default

Hostile is a confident detection, suspicious one to review. LN expects N hostile false positives per 100 million benign files; raising it moves detections from suspicious to hostile · 641 zero-day samples, median 6 h old · 682 known-good

Detected per engine identical cohortEcosystem

Atomdrift

76.1% (≥ suspicious)

VirusTotal

64.0% (n≥1)

malcontent

59.8% (≥ high)

ossgadget-backdoor

39.6%

ClamAV

23.7%

GuardDog

16.2% (risk≥5)

Aikido Malware

14.4%

SafeDep

14.0%

Socket

13.7%

malscan

0.0%

detected as hostile detected as suspicious not detected, or no record · a miss out of scope · a miss errored · a miss

Reputation lookups (Socket, Aikido, SafeDep) answer whether a package has been reported. 391 of 638 samples weren't registry packages at all; of the 247 Socket could look up, it had a record for 88.

VirusTotal is 62 engines voting, one upload at a time: its public API allows four lookups a minute and five hundred a day. We upload the malware it has never seen; known-good files are only looked up. How Atomdrift decides →

Runs on your cores. Local, CPU-only, air-gapped if you like. No per-query bill, no rate limit, no upload.

Reads 100+ formats. Source in every major language, ELF, PE, Mach-O, firmware, containers, archives, documents; packages from 47 registries.

Built to be embedded. Exit codes, JSON, an HTTP service, Rust libraries. Apache-2.0: ship it inside what you sell.

Detected as hostile: malware vs. known-good sliders try each engine's other settings

VirusTotal n≥6n≥1 n≥4 56.3% · 0.1% FP Atomdrift L0L2000–L2500 L25 55.1% · 0.1% FP malcontent criticalcritical+high critical 36.3% · 1.2% FP GuardDog risk≥10risk≥5 risk≥7 13.6% · 0.0% FP

Detection and false-positive chart data

VirusTotal n≥6: 53.0% of malware detected as hostile, 0.1% of known-good detected as hostile.
VirusTotal n≥5: 54.8% of malware detected as hostile, 0.1% of known-good detected as hostile.
VirusTotal n≥4: 56.3% of malware detected as hostile, 0.1% of known-good detected as hostile (default).
VirusTotal n≥3: 58.3% of malware detected as hostile, 0.1% of known-good detected as hostile.
VirusTotal n≥2: 60.4% of malware detected as hostile, 0.3% of known-good detected as hostile.
VirusTotal n≥1: 64.0% of malware detected as hostile, 0.3% of known-good detected as hostile.
Atomdrift L0: 25.1% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1–L10: 25.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L25: 55.1% of malware detected as hostile, 0.1% of known-good detected as hostile (default).
Atomdrift L50: 55.5% of malware detected as hostile, 0.1% of known-good detected as hostile.
Atomdrift L100–L250: 61.0% of malware detected as hostile, 0.1% of known-good detected as hostile.
Atomdrift L500–L1000: 75.8% of malware detected as hostile, 0.3% of known-good detected as hostile.
Atomdrift L2000–L2500: 76.1% of malware detected as hostile, 0.3% of known-good detected as hostile.
malcontent critical: 36.3% of malware detected as hostile, 1.2% of known-good detected as hostile (default).
malcontent critical+high: 59.8% of malware detected as hostile, 7.2% of known-good detected as hostile.
ClamAV hostile: 23.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Aikido Malware hostile: 14.4% of malware detected as hostile, 0.0% of known-good detected as hostile.
SafeDep hostile: 13.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
Socket hostile: 13.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 1.1% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 1.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 8.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥7: 13.6% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
GuardDog risk≥6: 14.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥5: 16.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.

VirusTotal n≥6n≥1 n≥4 96.0% · 0.0% FP Atomdrift L0L2000–L2500 L25 86.9% · 0.0% FP malcontent criticalcritical+high critical 50.0% · 4.3% FP GuardDog risk≥10risk≥5 risk≥7 0.0% · 0.0% FP

Detection and false-positive chart data

VirusTotal n≥6: 96.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥5: 96.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥4: 96.0% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
VirusTotal n≥3: 96.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥2: 97.2% of malware detected as hostile, 4.3% of known-good detected as hostile.
VirusTotal n≥1: 97.7% of malware detected as hostile, 4.3% of known-good detected as hostile.
Atomdrift L0: 9.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1–L10: 9.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L25: 86.9% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
Atomdrift L50: 86.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L100–L250: 90.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L500–L1000: 95.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L2000–L2500: 95.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
ClamAV hostile: 64.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
malcontent critical: 50.0% of malware detected as hostile, 4.3% of known-good detected as hostile (default).
malcontent critical+high: 80.7% of malware detected as hostile, 13.0% of known-good detected as hostile.
Aikido Malware hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥7: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
GuardDog risk≥6: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥5: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
SafeDep hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Socket hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.

GuardDog risk≥10risk≥5 risk≥7 46.1% · 0.0% FP Atomdrift L0L2000–L2500 L25 16.5% · 0.0% FP malcontent criticalcritical+high critical 6.1% · 1.4% FP VirusTotal n≥6n≥1 n≥4 2.6% · 0.0% FP

Detection and false-positive chart data

Aikido Malware hostile: 47.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
SafeDep hostile: 47.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 4.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 6.1% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 22.6% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥7: 46.1% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
GuardDog risk≥6: 49.6% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥5: 54.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
Socket hostile: 40.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L0: 0.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1–L10: 0.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L25: 16.5% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
Atomdrift L50: 17.4% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L100–L250: 39.1% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L500–L1000: 57.4% of malware detected as hostile, 1.4% of known-good detected as hostile.
Atomdrift L2000–L2500: 57.4% of malware detected as hostile, 1.4% of known-good detected as hostile.
malcontent critical: 6.1% of malware detected as hostile, 1.4% of known-good detected as hostile (default).
malcontent critical+high: 40.0% of malware detected as hostile, 2.7% of known-good detected as hostile.
VirusTotal n≥6: 2.6% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥5: 2.6% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥4: 2.6% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
VirusTotal n≥3: 3.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥2: 6.1% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥1: 14.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
ClamAV hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.

VirusTotal n≥6n≥1 n≥4 92.5% · 0.0% FP malcontent criticalcritical+high critical 91.4% · 4.1% FP Atomdrift L0L2000–L2500 L25 89.2% · 0.0% FP GuardDog risk≥10risk≥5 risk≥7 0.0% · 0.0% FP

Detection and false-positive chart data

VirusTotal n≥6: 91.4% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥5: 91.4% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥4: 92.5% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
VirusTotal n≥3: 93.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥2: 93.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥1: 95.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
malcontent critical: 91.4% of malware detected as hostile, 4.1% of known-good detected as hostile (default).
malcontent critical+high: 95.7% of malware detected as hostile, 24.5% of known-good detected as hostile.
Atomdrift L0: 78.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1–L10: 78.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L25: 89.2% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
Atomdrift L50: 89.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L100–L250: 89.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L500–L1000: 93.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L2000–L2500: 93.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
ClamAV hostile: 38.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Aikido Malware hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥7: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
GuardDog risk≥6: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥5: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
SafeDep hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Socket hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.

VirusTotal n≥6n≥1 n≥4 73.5% · 0.0% FP Atomdrift L0L2000–L2500 L25 59.0% · 0.0% FP malcontent criticalcritical+high critical 24.1% · 0.0% FP GuardDog risk≥10risk≥5 risk≥7 0.0% · 0.0% FP

Detection and false-positive chart data

VirusTotal n≥6: 60.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥5: 69.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥4: 73.5% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
VirusTotal n≥3: 80.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥2: 86.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥1: 92.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L0: 45.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1–L10: 45.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L25: 59.0% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
Atomdrift L50: 59.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L100–L250: 61.4% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L500–L1000: 91.6% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L2000–L2500: 92.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
malcontent critical: 24.1% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
malcontent critical+high: 36.1% of malware detected as hostile, 2.6% of known-good detected as hostile.
Aikido Malware hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ClamAV hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥7: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
GuardDog risk≥6: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥5: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
SafeDep hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Socket hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.

GuardDog risk≥10risk≥5 risk≥7 42.6% · 0.0% FP Atomdrift L0L2000–L2500 L25 19.7% · 0.0% FP malcontent criticalcritical+high critical 18.0% · 0.0% FP VirusTotal n≥6n≥1 n≥4 1.6% · 0.0% FP

Detection and false-positive chart data

Socket hostile: 55.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
SafeDep hostile: 50.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 3.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 3.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 31.1% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥7: 42.6% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
GuardDog risk≥6: 47.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥5: 47.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
Aikido Malware hostile: 26.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L0: 9.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1–L10: 11.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L25: 19.7% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
Atomdrift L50: 21.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L100–L250: 23.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L500–L1000: 59.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L2000–L2500: 59.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
malcontent critical: 18.0% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
malcontent critical+high: 50.8% of malware detected as hostile, 11.9% of known-good detected as hostile.
VirusTotal n≥6: 1.6% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥5: 1.6% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥4: 1.6% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
VirusTotal n≥3: 1.6% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥2: 3.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥1: 4.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
ClamAV hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.

VirusTotal n≥6n≥1 n≥4 56.3% · 0.0% FP GuardDog risk≥10risk≥5 risk≥7 50.0% · 0.0% FP malcontent criticalcritical+high critical 50.0% · 0.0% FP Atomdrift L0L2000–L2500 L25 25.0% · 0.0% FP

Detection and false-positive chart data

Aikido Malware hostile: 81.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥6: 50.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥5: 50.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥4: 56.3% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
VirusTotal n≥3: 56.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥2: 56.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥1: 56.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 12.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 50.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥7: 50.0% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
GuardDog risk≥6: 50.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥5: 75.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
malcontent critical: 50.0% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
malcontent critical+high: 100.0% of malware detected as hostile, 11.9% of known-good detected as hostile.
Atomdrift L0: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1–L10: 25.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L25: 25.0% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
Atomdrift L50: 25.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L100–L250: 25.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L500–L1000: 31.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L2000–L2500: 31.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
ClamAV hostile: 6.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
SafeDep hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Socket hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.

Each dot is an engine at one setting, plotting what it detects as hostile there; its suspicious detections, counted in the bars above, are not plotted. Defaults: Atomdrift L25 (as shipped), VirusTotal n≥4 (engines agreeing), malcontent critical, GuardDog risk≥7 (its “likely malicious”). Socket, Aikido Malware and SafeDep had no record of any known-good file they could look up, and VirusTotal had a record of 173 of 682. No record counts as not flagged, so those false-positive rates include files the engine never judged.

Run by run last 30 days · detected, hostile or suspicious, as the bars count it

Each point is the malware one run added, scored like the bars above. A sample drawn again within the week counts in the run that first scanned it, so the shaded runs pool to exactly the figures at the top. A fresh cohort every run, so every line swings. Judge us on the worst night, not the best.

False positives

Of 682 known-good samples, Atomdrift detected 2 (0.3%): 1 as hostile (0.1%) and 1 as suspicious (0.1%).

File type	Hostile	Suspicious
apk_android	com.termux_118.apk
pkg_macos		LMCP-Installer.pkg

isotope13.io: new rules the hour they clear QA, an API, and someone on the hook.

Appendix — samples and methodology all 638, every one linked

What “zero-day” means here. Every detection sample first appeared in the wild less than 48 hours before the run (median 6 h, youngest 0.9 h): too new for reputation or download history to form, and usually for a signature of its own — though one from a known family can still match an older signature, which is why signature engines score at all. Catching malware a feed has already named is a different, easier problem.

How this is scored. Every engine gets the identical cohort, and a skip counts as a miss for everyone — a file nobody scanned is a file nobody detected. The bars count everything an engine detects, down to the setting named beside it; the chart counts what it detects as hostile, one dot per setting. A sample drawn by more than one run in the window counts once, at its first scan. A listing from a contestant's own feed counts only once an independent engine corroborates it. The 682 known-good samples are 273 registry packages, 77 project and vendor downloads and 332 files whose source wasn't recorded, which reached our collection up to 61 days before they were scanned (median 40). Each is re-checked later: one that turns out to be malware is dropped from the false-positive rates, and any engine that flagged it is credited with an early detection. We run this benchmark and we're one of the engines in it, so we publish every sample, verdict and rate.

Engine versions: Atomdrift 2.13.0 · ClamAV 1.5.2 · GuardDog 3.2.0 · malcontent 1.28.1 · ossgadget-backdoor v0.2.38 source-sha256:d7b34b9d836784bcf38fd191f92db9489590916837f4ab39d561167a9cd6440e (VirusTotal, Socket, Aikido Malware, SafeDep are hosted, so unversioned).

Why the cohort isn't a random sample. A plain random draw from the malware and open-source firehoses is dominated by whatever published most: three registries took 70% of the known-good seats and Windows executables 60% of the malware seats, which left most file formats never measured at all. So each cohort is built from two parts. Most seats track the real population, damped by a square root so the biggest format stays the biggest without crowding out everything else. The rest go one-per-format on a rotation, and that rotation is the only reason a Firefox add-on or a Conda package appears here at all. Over the last 7 days: 447 proportional seats and 194 rotation seats on the malware side, across 13 formats.

So every rate is published twice. The bars show the rate over this cohort. Because the cohort over-samples rare formats deliberately, that is not what an engine would score on the population — so each rate is also re-weighted by every format's true share of it.

Weighted to the population (hostile + suspicious): VirusTotal 94.4% · Atomdrift 93.2% · malcontent 80.0% · ClamAV 62.3% · ossgadget-backdoor 7.1% · GuardDog 2.5% · Aikido Malware 2.2% · SafeDep 2.2% · Socket 1.9% · malscan 0.0%.

On the false-positive side they speak for 99%: nothing was drawn for 3ossl, 931, ahk, apinotes, bar, cnf, cran, graphql, imports, inc, jsonc, la, list, makefile, ocx, omo, ooxml, phs, reibl, rule, scl, scr, sdb, seq, sha1, sln, swf, template, vcp, web.

Re-weighting costs precision, so here is the cost: these 641 malware samples carry the statistical weight of 221 once weighted.

Point it at anything.

curl -fsSL https://install.atomdrift.org/scan.sh | sh

More zero-day malware detected as hostile than VirusTotal, at the same false-positive rate — on your own hardware.

Detected per engine identical cohortEcosystem All · 641Windows · 176JavaScript · 115Linux/BSD · 93Scripts · 83Python · 61Browser Extensions · 46Go · 16macOS · 15Java · 12Rust · 6Archives · 5Documents · 5.NET · 3Android · 2Other · 2Editor Extensions · 1

Detected as hostile: malware vs. known-good sliders try each engine's other settings

Detection and false-positive chart data

Detection and false-positive chart data

Detection and false-positive chart data

Detection and false-positive chart data

Detection and false-positive chart data

Detection and false-positive chart data

Detection and false-positive chart data

Run by run last 30 days · detected, hostile or suspicious, as the bars count it

False positives

Point it at anything.

Detected per engine identical cohortEcosystem