About

xz-utils was not a fluke. It was a preview. Atomdrift is open-source malware and supply-chain attack detection, built for what's coming next.

We build the tools, train the models, and write the rules. Our detection tools are simple, fast, local-first, and designed to be integrated into any pipeline or product. Built for open source, we're obsessively multi-platform, and everything is Apache 2.0.

News

• 2026-08-14 cleave & Scan v2.7.1, isomer v0.4.0 CPU work, mostly. cleave is about 25% faster; Scan and isomer embed it, so they are too. Four file-type rules that never ran now run. isomer v0.4.0 adds three detectors that need no rules.
• 2026-08-13 isomer v0.3.0: learning from 30 years of attacks — plus cleave & Scan v2.7.0 This cycle was about shaping isomer into something useful: verdicts being calibrated against 30 years of real supply-chain attacks, cleanups no longer read as attacks, and the LLM can never raise the CI gate. cleave and Scan v2.7.0 carry the changes isomer needed. First release where all three ship prebuilt binaries.

All news →

Projects

• scan stable
  Local malware scanner. Runs azoth and other open models over capabilities extracted by cleave, across binaries, scripts, source, packages, and archives.
• azoth stable
  Open model bundle for malware detection. A routed ensemble over cleave's capabilities, covering more than 100 file and container types. Runs on CPU.
• cleave stable
  Static analysis and capability extraction for source, binaries, bytecode, packages, archives, documents, and deployment configuration.
• stng stable
  String extraction for binary analysis that keeps the signal and drops the noise. Used for triage, C2 enumeration, credential extraction, and signature development.
• filefacts stable
  Rust library that reads a file once and returns ML-ready facts: package identity, binary provenance, source AST features, strings, symbols, metrics, and structured errors.
• isomer experimental
  Differential analyzer that judges whether the change between two versions is malicious. Built for subtle attacks like xz-utils. In heavy development.
• hood experimental
  Local gate for software fetched by developers and AI agents. Scans public and private artifacts before they reach a package manager, installer, or curl | sh, without changing your workflow.