isomer v0.3.0 judges the shape of a change, not the size of it. We've begun calibrating its heuristics against the compendium — 30 years of real supply-chain attacks, from Ken Thompson's compiler to last month's npm worms — and that work continues. A focused source implant, a cross-domain capability cluster gained on a tiny version bump, an encrypted payload in a same-version repack: each escalates on its own. The fixture set now includes unrealircd's 2010 backdoored tarball, and isomer flags it at a severity that would fail a CI gate.
Cleanups are no longer attacks. Removing a backdoor used to look like a large, suspicious change. Remediation is now a first-class outcome with its own severity floor, and the output gains a "removed" section. Only the risk jump counts — a scary package's ordinary update isn't condemned for its baseline. The LLM can raise the displayed severity but never the CI gate.
Its dependencies grew what it needed. cleave v2.7.0 analyzes
identical bytes once across both sides of a diff, skips unchanged members,
and keeps files that are hostile on both sides visible instead of
filtering them as "no change". Scan v2.7.0 grades every embedded
file — the old 100-member cap meant a hostile file at index 347 never
elevated its parent — and applies registry findings to fetched dependencies
before grading. Both take --zip-password for encrypted archives.
Prebuilt binaries, all three, for the first time. macOS builds are signed and notarized; cleave and Scan also cover Linux, Windows, and the BSD/illumos family. Installers are coming soon.
Release notes: isomer v0.3.0 · cleave v2.7.0 · scan v2.7.0
brew upgrade atomdrift-project/tap/cleave atomdrift-project/tap/scan