cleave & Scan v2.7.1, isomer v0.4.0
CPU work, mostly. cleave is about 25% faster; Scan and isomer embed it, so they are too. Four file-type rules that never ran now run. isomer v0.4.0 adds three detectors that need no rules.
Atomdrift News
Latest posts
isomer v0.3.0: learning from 30 years of attacks — plus cleave & Scan v2.7.0
This cycle was about shaping isomer into something useful: verdicts being calibrated against 30 years of real supply-chain attacks, cleanups no longer read as attacks, and the LLM can never raise the CI gate. cleave and Scan v2.7.0 carry the changes isomer needed. First release where all three ship prebuilt binaries.
hood, an early supply-chain firewall experiment
hood inspects the software your tools fetch — public or private — on your own machine, before you run it. It is an early experiment, released quietly to see how it behaves in the field.
Introducing isomer — design partners wanted
isomer is our differential supply-chain attack detector: an early, experimental build that judges the change between two versions instead of scoring a tree in isolation. We're looking for a few design partners to make sure we're building the right thing.
Precompiled binaries and a one-line installer
Atomdrift Scan now ships prebuilt binaries for eight Linux architectures, macOS, the BSDs, Solaris/illumos, Android, and Windows — with a new installer at install.atomdrift.org that verifies what it downloads before it replaces anything. Testers welcome.
cleave & Scan v2.5.0: quiet failures get loud, and cleave lands on Windows
Files that used to produce no verdict at all — a truncated archive, a half-written gzip, a member that failed to scan — now say so. Plus ISO analysis, verified Mach-O signatures, five seconds off every cold start, and first builds for Windows, DragonFlyBSD, NetBSD, illumos/OmniOS and Solaris 11.4.
New home on GitHub — and v2.4.0 across the board
Every Atomdrift project has moved to GitHub, and we're marking the occasion with a coordinated v2.4.0: first-class dependency scanning, 16 GiB files, and faster archives — landing the same week Scan posted its best head-to-head run yet at 94% detection with zero false positives.
cleave & Scan v2.3.0: a third of the memory, twice the speed
The headline is performance — rebuilt regex internals, parallel archive evaluation, and workers that stop hoarding memory deliver the same deterministic verdicts at a third of the memory and twice the speed — with a stack of accuracy fixes riding along.
Atomdrift Scan v2.2.0: it checks what your code brings with it
Scan stops trusting a project's own ingredient list — v2.2.0 fetches and scans the outside code your project pulls in, screens it through bloom filters first, and inherits new formats and byte-level evidence from the engine beneath it.
Lab down today: growing the database to 4TB before the admins disappear for summer vacation
The Atomdrift lab is offline for hardware maintenance today while engineers grow storage on the PostgreSQL master and its replicas to hold a 4TB dataset — the corpus of analyses we now track for more than 41 million files.
Atomdrift Scan v2.1.0, cleave v2.1.1
Scan learns to reach out — fetch and scan remote dependencies, packages, and URLs directly — while cleave makes YARA fast with precompiled rules and on-demand tier loading.
db-xorma: malware laundered through legit npm packages
db-xorma's tarball carries no payload — just a clone of a real ORM whose one bolted-on method launders the attack through a real installer and a second cloned package, pulling the obfuscated BeaverTail loader from a paste host at runtime.
cleave v2.1.0, stng v1.7.0, filefacts v1.1.0 & v1.1.1
A package-aware wave: cleave learns DMG and go.mod, filefacts grows real lockfile parsing and PURL extraction, and stng adds generic decoded-string recovery for text.
cleave v2.0.0, stng v1.6.2, filefacts v1.0.1
The rest of the 2.0 stack lands alongside Atomdrift Scan: cleave's engine swap reaches stable, stng kills a class of XOR false positives, and filefacts goes panic-safe.
🎉 Atomdrift Scan v2.0.0 (formerly litmus)
litmus grows up: renamed Atomdrift Scan, now generally available on pure-Rust ONNX inference, with false-positive-budget severity, an optional local-LLM second opinion, and signed model bundles.
@sqlite-node/createsql: the DPRK's npm quota, fulfilled via GitHub Gist
The 707-byte package ships nothing but a fetch-and-eval; four hops later the same BeaverTail-to-InvisibleFerret kit from three prior finds is back on a brand-new IP, running a node-pty shell and hunting wallet seed phrases.
surf: BYO-Interpreter — a faked Go library hides a LuaJIT payload
The real surf is a browser-impersonating Go library you import; the clone forgot to rename its module, turned its README into a Download button, and hides a LuaJIT screenshot-stealer in a 309 KB line of obfuscated text.
filefacts v1.0.0
filefacts reaches 1.0.0 with richer package identity, new PE/.NET malware features, better evidence offsets, and explicit AST failure metrics for large-scale security ML pipelines.
onering: a crate that leaks unreleased source
The poison runs in your repo, not the library's — cargo's build dir leads build.rs to the consuming project's git tree, where it scrapes the latest commit's author, email and full patch, then POSTs it as a routine Sentry crash report.
cleave v2.0.0-rc.5, litmus v2.0.0-rc.5, stng v1.6.0, filefacts v0.9.5
Everything got a bump, and updates no longer need git: cleave and litmus now pull signed, sha256-verified .tar.zst bundles from R2 — atomic install, pin/check/update — plus richer package, PE/CLR, and Mach-O signals across the stack.
express-timer: an npm 'security helper' that self-destructs your src/
Most malicious npm packages steal; this one just deletes your source tree a minute after you install it — and its author fumbled their own online-banking password into the very same tarball.
path-internal-util: don't chase the URL, catch the shape
It's the real Joyent path module, verbatim, plus three lines that fetch a jsonkeeper paste and eval it — pull that thread and it unrolls into a live DPRK BeaverTail loader and a socket.io RAT.
v018-axios-cdntest: C is for cookie, not cryptojacking
It ships a self-described 'cryptojacker payload' that POSTs shares to a stratum port over XHR and mines exactly nothing — yet the cookie stealer bolted onto real axios works fine, and the README reads like a startup pitch deck.
cleave v2.0.0-rc.4, litmus v2.0.0-rc.4, stng v1.5.2, filefacts v0.9.0
Four releases, one storyline: the filefacts engine swap deepens, and the pipeline gets dramatically cheaper to run — bounded archive analysis, a fixed ~7.7 GB regex leak, −60% peak RSS, streaming JSON everywhere.
awaitly-visualizer: The miasma continues to floweth — a binding.gyp Bun worm
No install hook to flag — npm auto-builds the binding.gyp it ships, which fetches its own Bun runtime to run a credential-harvesting worm outside node's view, forge Sigstore provenance, and republish the maintainer's other packages.
spadata: Gimme all your Roblox — the PyPI DataStore lib that isn't
It promises a Roblox DataStore library and ships none of it — just an __init__.py that, on import, DPAPI-decrypts your Roblox session cookie and posts the cleartext to a Discord webhook; the README can't even spell its own name.
sourceflow-tracker: I Has a Bucket — npm fetches its payload from GCS
A 379-byte package whose only load-bearing content is a dependency version string pointing into a Google Cloud Storage bucket — so npm itself downloads and detonates the payload, and the registry never holds a copy to scan.
cleave v2.0.0-rc.3, litmus v2.0.0-rc.3, stng v1.5.1
Two release candidates and a point release: cleave and litmus both move to 2.0.0-rc.3, closing the gap between capability extraction and the azoth model, while stng v1.5.1 stops mistaking compiler tables for hardcoded IPs.
clx-cookieparser: a cookie-parser clone whose evil twin is North Korean
The package you install is the real express cookie-parser, tests and all — the theft lives one require() away in a twin dependency that pulls the DPRK's BeaverTail-to-InvisibleFerret kit, run by the same crew as web-dotenv.
aes-decode-runner-pro: an 'AES demo' that decrypts itself into a RAT
A tutorial-shaped AES codec whose import decrypts its own hardcoded ciphertext, pulls a 6 MB payload from nvidiadriver.net, and unpacks the Winpatch RAT — which impersonates lsass.exe to lift Chrome's app-bound encryption keys.
@polka-ui/config: a postinstall that announces itself, then drops Sliver
It stamps its own payload 'authorized testing only,' then — past the Russian comments — exfils every npmrc and env secret and drops a real Go Sliver implant beaconing to a Russian host; the PoC label is the alibi.
Atomdrift lab going dark for bandwidth upgrade
The Atomdrift research lab will be offline for several hours today while engineers upgrade the uplink feeding forager, the in-house crawler that has been pinned at line rate around the clock pulling releases from more than 100 software marketplaces.
shop-minis: a Shopify-shaped canary that rats you out to Burp
A 762-byte dependency-confusion probe wearing the name of Shopify's private Shop Minis package, that slurps your CI env vars and ships them out two ways at once — HTTPS and DNS — to a Burp Collaborator.
web-dotenv: a dotenv clone, plus one function that robs you
A near-perfect copy of dotenv — 50M downloads a week — with one function bolted into config(), so booting your app fetches a stealer that combs $HOME for wallets and keys and watches your clipboard on a 750 ms loop.
cleave v2.0.0-rc.1, litmus v2.0.0-rc.1, stng v1.4.0
The 2.0.0-rc.1 series swaps cleave's file-parsing engine out for filefacts, a standalone library you can use without the rest of cleave. litmus picks up a new JSON schema and ONNX. stng tightens the garbage filter and fixes a stack-string panic.
api-rs-node: a fake Rust bridge that doxxed its own author
A 'high-performance Rust bridge' that's really a Windows dropper — IPFS payload, registry persistence, a beacon on port 2026 — whose author bundled their own config files and named the very machine they built it on.
@devcarron/clob: api-rs-node's rough draft, same binary, same self-dox
The same Windows implant as api-rs-node, shipped 5½ hours earlier under a copy-pasted sharp README its author forgot to re-title — and the bundled config files finger the same dev machine twice over.
system-user-identifier-cli: an 'identity helper' that just opens a reverse shell
799 bytes, two files, and a name like a thousand throwaway npx tools — it really does check your user id, then drops a bash /dev/tcp reverse shell and calls home.
stng v1.3.1, litmus v1.2.1, cleave v1.4.0
Three pre-CackalackyCon releases: stng tightens mixed binary/script decoding, litmus improves worker reporting and model bundle handling, and cleave deepens PDF and LNK analysis.
litmus v1.2.0
Preview support for the azoth ensemble. Multi-seed averaging, per-route isotonic calibration, LightGBM alongside XGBoost. Models route per file from a top-level config.
cleave v1.3
cleave diff is the signal we have been building toward: a structured, scoped delta between two versions of the same software, with an estimated rate of change that nobody else is measuring. kv now covers PE/ELF/Mach-O along with Office, PDF, PyInstaller, CHM, and a long tail of source and archive formats, with much deeper binary provenance.
Lab outage: btrfs cannot delete its way out of a full disk
The lab's PostgreSQL master is offline: btrfs filled up and now refuses to delete files — or even snapshots — because it is out of space. No data was lost, thanks to our distributed replica architecture. We are moving the master to ZFS on OmniOS and teaching the lab to fail over to a replica. ETA back online: today.
stng v1.3.0
Go and Rust PE recovery, multi-key XOR via lea-near-xor analysis, and a pile of fixes for things that were quietly wrong.
Release Mania: stng v1.2.1, cleave v1.2.0, litmus v1.1.0
cleave fixes a class of rayon deadlocks, parses Python pickle and MSI-embedded PE, and skips rizin on Go binaries for a real speedup; litmus gains worker-mode fleet scanning behind a hardened HTTP server; stng stops mis-flagging Kotlin as Python.
stng v1.2.0
Preserve Telegram bot tokens, JWTs, and Swift mangled symbols that the chaos filter was dropping; cut XOR IP false positives inside binary data tables.
cleave v1.1.0
PE Authenticode chain extraction and ~100 new ELF/Mach-O fields; archive scanning raised from 1K to 100K members; breaking V4 output schema.
stng v1.1.8
Aho-Corasick rewrite of XOR/string classification and parallel disassembly via iced-x86; fixes a PE/XOR bug that was missing office_update-style samples.
Atomdrift is here!
Atomdrift launches: an open-source pipeline for catching supply-chain attacks the static-binary tools miss. First piece is litmus.
litmus v1.0.0
First tagged release. Open-source malware classifier with TreeSHAP-explained verdicts; CPU-only, offline, no telemetry. Default model is beta — not production-ready yet.