Atomdrift Scan · supply-chain malware detection · Apache-2.0

Open-source malware scanning on your infrastructure.

Scan source, binaries, packages, archives, URLs, and running processes with local static analysis and ONNX models. No cloud scanner or API key is required, and every verdict includes the capabilities that drove it.

Built for security teams that need an inspectable CLI, an air-gap mode, CI-friendly exit codes, or an engine they can embed and self-host.

Install it → How it decides See every sample

curl -fsSL https://install.atomdrift.org/scan.sh | sh

Apache-2.0 47 registries 100+ file types no telemetry Linux · macOS · BSD · illumos

82%

malware caught

false alarms

False-positive budget

-l 0-l 25000

at -l 50 — the shipped default, untuned

As of 2026-08-06.

Latest results 50 malware samples, none older than 48 hours · 2026-08-06

Atomdrift

82%

VirusTotal

64%

malcontent

46%

Socket

32%

ClamAV

22%

SafeDep

22%

GuardDog

20%

Aikido Malware

16%

flagged hostile flagged suspicious unsupported file format

Every engine is scored at its most sensitive setting, ours included. 90% is the top of our dial; 82% is the shipped default. Both beat the field.

Grey is scope: engines that only read packages from registries they support mark the rest of the cohort as an unsupported file format.

Catch rate vs. false alarms everyone else is a dot — we're the line

Only the top-right corner counts: catch the malware, spare the clean code. Every rival is one dot — one setting, chosen for you. We're the curve.

-l is a false-positive budget — files flagged per 100 million, calibrated per file type. Not “medium sensitivity”; a number you can plan a pipeline around.

50 malware samples against 49 known-good packages. False-alarm axis inverted, so up and right is better.

Every run before this one each draws a fresh cohort from live feeds

Most engines swing sixty points as the cohort changes. Judge us on the worst night, not the best.

Each run draws a fresh cohort, so movement is the samples changing as much as the engines.

How it differs static analysis in addition to reputation

Reputation is useful for known files, but a newly published package may have no record. Atomdrift checks known-good and known-bad hashes first, then unpacks the artifact, extracts capabilities from its code and structure, and scores that evidence locally. How it works →

It's yours Apache-2.0 — embed it, fork it, ship it in something you sell

Socket, Aikido, SafeDep and VirusTotal are services you rent. That's not a licensing detail — it decides what you're allowed to build.

A scanner you rent

Priced per seat or per scan, forever
Needs the network — no air-gap, no offline CI
Can't go inside a product you sell
Can't see the rule that flagged your build
A false positive gets fixed when the vendor feels like it
Your code goes to their servers

A scanner you own

Apache-2.0. Free at any volume, forever
Runs air-gapped after bundles are installed
Embed it in your own product and sell that
Engine, traits, and model bundles are inspectable
Fix it yourself this afternoon, or fork it
Files are analyzed locally; update and reference fetching are controllable

Run atomscan version to inspect the exact traits, YARA rules, bloom filters, and ONNX models installed on a machine. The same engine is available as a CLI, library, HTTP service, or distributed worker, so teams can move from a workstation to a scan fleet without changing the analysis model.

Appendix — samples and methodology all 50, every one linked

How this is scored. Samples come from live public malware feeds, none older than 48 hours. Every engine gets the identical cohort, and a skip counts as a miss for all of them — a file nobody scanned is a file that got through. A listing from a feed belonging to one of the contestants only counts once an independent engine corroborates it, so nobody is credited for their own report. Presumed-good packages are drawn from the freshest 48 hours of the open-source firehose and re-checked on later runs: one that turns out to be malware is removed from that run's false-positive rates, and any engine that flagged it is credited with an early detection. We run this benchmark and we're one of the engines in it, so every sample, verdict and rate is published.

Engine versions: Atomdrift 2.5.0 · ClamAV 1.5.3 · GuardDog 3.1.0 (locally-run engines; VirusTotal, Socket, Aikido Malware, SafeDep are hosted services queried live, so they carry no pinned version).

Point it at your dependencies.

Apache-2.0 · local analysis · explicit offline mode