Install Atomdrift

The open-source malware scanner that doesn’t suck. Checks files, directories, archives, packages, URLs, and running processes with static analysis and CPU-based ML.

Uses Homebrew when available · releases · docs

Static analysis that answers what a program can do. Unpacks source, binaries, bytecode, documents, and packages, then reports capabilities with the evidence behind them.

Uses Homebrew when available · releases · source

Differential supply-chain analysis: what a change does that the code before it didn’t. Compares two trees, commits, or package versions and judges the delta.

Early build — flags and output change · docs

A local check on what your package managers download. Shims npm, pip, go, curl, and friends, and classifies each artifact before it lands.

Pre-release: builds from source · then run hood install · source

Runs isomer on every pull request, on your own runner. Run this inside a checkout of the repository you want to protect: it writes one workflow file and never touches git.

--source-only

Audit the source only; skip the build-output comparison.

--dry-run

Print the workflow instead of writing it.

--force

Replace an existing workflow that differs.

Writes .github/workflows/supply-chain.yml, and nothing else · Node · Rust · Go · Python builds are compared · action