Atomdrift Scan is a local malware scanner built for the software supply chain: the package that landed on npm an hour ago, the binary in a vendor tarball, the thing a coworker just ran with curl | sh. Hand it a path, a PURL, a URL, or a process. It decomposes what it finds, scores it, and exits with a status code your CI can act on. (Scan was previously released as litmus.)

Nothing leaves your machine. cleave extracts what each file can do, azoth scores those capabilities on your CPU, and every verdict lists the capabilities that drove it. No cloud scanner, no API key, no GPU, no telemetry. The models retrain continuously from new samples, threat feeds, and published research, and ship about 1,000 rule updates a day.

Sensitivity is a false-positive budget, not a dial labelled medium. -l 25, the default, means 25 false positives per 100 million benign files. -l 0 means none observed. Go higher when missing something costs more than a second look.

It is measured every day against live zero-day malware, next to VirusTotal, Socket, ClamAV, and others. See the numbers →

Capabilities

• File scanning: files, directories, archives, PURLs, and URLs
• Process scanning: running processes, via their on-disk image. Memory-resident analysis is not implemented yet.
• Explainable verdicts: every score ships with a ranked list of the capabilities that drove it
• Optional LLM second opinion: --llm sends the extracted evidence to an OpenAI-compatible endpoint and blends the answer with the ML verdict
• Pluggable models: --model-dir swaps in any bundle trained on cleave's capability schema

Network behavior. Analysis is local. The CLI touches the network for two things: rule and model updates, at most once a day, and following the packages and URLs a sample references, so a clean wrapper cannot hide a dirty payload. Turn both off with SCAN_NO_UPDATE_CHECK=1 atomscan --no-update --fetch=none ….

Install

Installer (macOS, Linux, BSD, Solaris, illumos, and Android):

curl -fsSL https://install.atomdrift.org/scan.sh | sh

On macOS and Linux the installer hands off to Homebrew when it finds one, so Homebrew manages upgrades, PATH, and dependencies. Pass --method binary to use the prebuilt release directly.

Windows PowerShell:

irm https://install.atomdrift.org/scan.ps1 | iex

Every supported platform, requirement, and release download is on the install page.

From source:

git clone --depth 1 https://github.com/atomdrift-project/scan.git
cd scan
make install

Usage

$ atomscan <path>
$ atomscan -f json <path>    # machine-readable output
$ atomscan purl npm/[email protected]
$ atomscan url https://example.com/download

Exit codes, so CI needs no parsing:

0 benign   1 hostile   2 suspicious   3 analysis error   4 incomplete rule set; re-run

The first scan downloads the model, rule, and bloom-filter bundles. atomscan version prints the exact inventory installed.

For deeper binary analysis, install Rizin (disassembly), UPX (unpacking), and upstream 7-Zip (disk images; p7zip cannot read APFS, so .dmg contents go unscanned).