experimental
isomer
The version string says nothing changed; the behavior says otherwise.
isomer detects whether a change is malicious. It compares two states of the same thing — a directory, a git ref, a package, a container image — and judges the delta in context: capability drift, version-bump proportionality, commit intent, and behavioral disassembly, combined by a differential ML model (Valence). “Gained network and process-spawn between 1.2.3 and 1.2.4, and the changelog says fix typo” is a far higher-signal alert than any score on a whole tree — and it's exactly the shape of xz-utils, event-stream, and ua-parser-js. Offline command-line tool built for CI, powered by Atomdrift Scan. Apache-2.0, no telemetry.
Heavy development
isomer is an early, experimental build. Verdicts, flags, and output formats change without notice, and there is no stable release yet. Try it, break it, file issues — just don't wire it into anything you can't unwire. May eat your cat.
Design partners wanted
We're looking for a handful of design partners interested in the space — teams who can put isomer up against real pipelines and dependency churn, and tell us early whether we're designing the right thing. Interested? Contact Thomas Stromberg at t, at this domain.
The xz-utils test
isomer's benchmark is the hardest version of the problem: the
compiled, stripped liblzma.so from the 2024 xz-utils
backdoor. The 5.4.5 → 5.6.0 diff verdicts
HOSTILE — and with every known signature ignored, the
behavioral axis alone still reads high enough to fail CI, which is what
catching a novel xz-shaped attack on release day requires. The
5.6.0 → 5.6.3 diff correctly reads as the backdoor being
removed, not added.
Surface
isomer ci # zero-config in CI: derives base..head from the environment isomer fs <old-path> <new-path> # compare two trees; follows the dependency graph isomer git --repo <url> <old> <new> # compare two commits/branches/tags of a remote repo isomer purl <purl@a> <purl@b> # compare two published package versions isomer oci <old-image> <new-image> # compare two container images
Old, then new, like diff. Exit codes: 0 clean, 1 findings
at or above --fail-on, 2 operational error — never
conflated with findings.
Install
From source only while things are moving fast (Rust 1.94+):
git clone https://github.com/atomdrift-project/isomer.git cd isomer make install