More zero-day malware detected as hostile than VirusTotal, at the same false-positive rate — on your own hardware.

Over the last 7 days, set to L2500: 67.0% of live zero-day malware detected as hostile at 0.4% false positives. VirusTotal detected 47.7%, one upload at a time. Atomdrift reads the artifact and decides at scan time; nothing leaves your machine. The shipped default, L25, is beside it.

curl -fsSL https://install.atomdrift.org/scan.sh | sh

Apache-2.0 · Linux, macOS, Windows, BSD, illumos · no telemetry

Last 7 days · 10 runs · 2026-11-03

67.0%

Zero-day malware detected

0.4%

false positives

Hostile

51.9%

0.4% false positives

Suspicious

15.1%

0.0% false positives

at L2500: 67.0% hostile · 0.4% false positives

Sensitivity

L0L1000–L2500

at L25 — the shipped default

Hostile is a confident detection, suspicious one to review. LN expects N hostile false positives per 100 million benign files; raising it moves detections from suspicious to hostile · 470 zero-day samples, median 7 h old · 492 known-good

Detected per engine identical cohortEcosystem

Atomdrift

67.0% (≥ suspicious)

VirusTotal

56.2% (n≥1)

malcontent

52.8% (≥ high)

ossgadget-backdoor

39.1%

ClamAV

20.4%

Aikido Malware

15.5%

GuardDog

15.3% (risk≥5)

Socket

12.8%

SafeDep

10.2%

malscan

0.0%

detected as hostile detected as suspicious not detected, or no record · a miss out of scope · a miss errored · a miss

Reputation lookups (Socket, Aikido, SafeDep) answer whether a package has been reported. 251 of 463 samples weren't registry packages at all; of the 216 Socket could look up, it had a record for 60.

VirusTotal is 62 engines voting, one upload at a time: its public API allows four lookups a minute and five hundred a day. We upload the malware it has never seen; known-good files are only looked up. How Atomdrift decides →

Runs on your cores. Local, CPU-only, air-gapped if you like. No per-query bill, no rate limit, no upload.

Reads 100+ formats. Source in every major language, ELF, PE, Mach-O, firmware, containers, archives, documents; packages from 47 registries.

Built to be embedded. Exit codes, JSON, an HTTP service, Rust libraries. Apache-2.0: ship it inside what you sell.

Detected as hostile: malware vs. known-good sliders try each engine's other settings

Atomdrift L0L1000–L2500 L25 51.9% · 0.4% FP VirusTotal n≥6n≥1 n≥4 47.7% · 0.4% FP malcontent criticalcritical+high critical 28.5% · 1.4% FP GuardDog risk≥10risk≥5 risk≥7 12.3% · 0.8% FP

Detection and false-positive chart data

Atomdrift L0: 23.6% of malware detected as hostile, 0.2% of known-good detected as hostile.
Atomdrift L1: 23.8% of malware detected as hostile, 0.2% of known-good detected as hostile.
Atomdrift L5–L10: 24.0% of malware detected as hostile, 0.2% of known-good detected as hostile.
Atomdrift L25: 51.9% of malware detected as hostile, 0.4% of known-good detected as hostile (default).
Atomdrift L50: 52.1% of malware detected as hostile, 0.4% of known-good detected as hostile.
Atomdrift L100: 56.0% of malware detected as hostile, 0.4% of known-good detected as hostile.
Atomdrift L250: 56.2% of malware detected as hostile, 0.4% of known-good detected as hostile.
Atomdrift L500: 66.8% of malware detected as hostile, 0.4% of known-good detected as hostile.
Atomdrift L1000–L2500: 67.0% of malware detected as hostile, 0.4% of known-good detected as hostile.
VirusTotal n≥6: 45.1% of malware detected as hostile, 0.4% of known-good detected as hostile.
VirusTotal n≥5: 46.2% of malware detected as hostile, 0.4% of known-good detected as hostile.
VirusTotal n≥4: 47.7% of malware detected as hostile, 0.4% of known-good detected as hostile (default).
VirusTotal n≥3: 49.1% of malware detected as hostile, 0.4% of known-good detected as hostile.
VirusTotal n≥2: 51.3% of malware detected as hostile, 0.4% of known-good detected as hostile.
VirusTotal n≥1: 56.2% of malware detected as hostile, 0.4% of known-good detected as hostile.
malcontent critical: 28.5% of malware detected as hostile, 1.4% of known-good detected as hostile (default).
malcontent critical+high: 52.8% of malware detected as hostile, 8.3% of known-good detected as hostile.
ClamAV hostile: 20.4% of malware detected as hostile, 0.0% of known-good detected as hostile.
Aikido Malware hostile: 15.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
Socket hostile: 12.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 0.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 0.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 5.5% of malware detected as hostile, 0.2% of known-good detected as hostile.
GuardDog risk≥7: 12.3% of malware detected as hostile, 0.8% of known-good detected as hostile (default).
GuardDog risk≥6: 13.0% of malware detected as hostile, 0.8% of known-good detected as hostile.
GuardDog risk≥5: 15.3% of malware detected as hostile, 1.0% of known-good detected as hostile.
SafeDep hostile: 8.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.

GuardDog risk≥10risk≥5 risk≥7 46.9% · 3.4% FP Atomdrift L0L1000–L2500 L25 25.9% · 0.0% FP malcontent criticalcritical+high critical 7.4% · 1.7% FP VirusTotal n≥6n≥1 n≥4 1.2% · 0.0% FP

Detection and false-positive chart data

Aikido Malware hostile: 60.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 1.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 2.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 17.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥7: 46.9% of malware detected as hostile, 3.4% of known-good detected as hostile (default).
GuardDog risk≥6: 49.4% of malware detected as hostile, 3.4% of known-good detected as hostile.
GuardDog risk≥5: 58.0% of malware detected as hostile, 5.2% of known-good detected as hostile.
Socket hostile: 33.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L0: 14.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1: 14.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L5–L10: 14.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L25: 25.9% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
Atomdrift L50: 25.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L100: 37.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L250: 37.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L500: 51.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1000–L2500: 51.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
SafeDep hostile: 19.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
malcontent critical: 7.4% of malware detected as hostile, 1.7% of known-good detected as hostile (default).
malcontent critical+high: 45.7% of malware detected as hostile, 8.6% of known-good detected as hostile.
VirusTotal n≥6: 1.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥5: 1.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥4: 1.2% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
VirusTotal n≥3: 4.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥2: 4.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥1: 14.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
ClamAV hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.

VirusTotal n≥6n≥1 n≥4 70.4% · 3.7% FP Atomdrift L0L1000–L2500 L25 51.9% · 0.0% FP malcontent criticalcritical+high critical 18.5% · 3.7% FP GuardDog risk≥10risk≥5 risk≥7 0.0% · 0.0% FP

Detection and false-positive chart data

VirusTotal n≥6: 61.1% of malware detected as hostile, 3.7% of known-good detected as hostile.
VirusTotal n≥5: 68.5% of malware detected as hostile, 3.7% of known-good detected as hostile.
VirusTotal n≥4: 70.4% of malware detected as hostile, 3.7% of known-good detected as hostile (default).
VirusTotal n≥3: 72.2% of malware detected as hostile, 3.7% of known-good detected as hostile.
VirusTotal n≥2: 75.9% of malware detected as hostile, 3.7% of known-good detected as hostile.
VirusTotal n≥1: 77.8% of malware detected as hostile, 3.7% of known-good detected as hostile.
Atomdrift L0: 33.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1: 35.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L5–L10: 37.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L25: 51.9% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
Atomdrift L50: 53.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L100: 53.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L250: 53.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L500: 81.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1000–L2500: 81.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
malcontent critical: 18.5% of malware detected as hostile, 3.7% of known-good detected as hostile (default).
malcontent critical+high: 38.9% of malware detected as hostile, 3.7% of known-good detected as hostile.
Aikido Malware hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ClamAV hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥7: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
GuardDog risk≥6: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥5: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
SafeDep hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Socket hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.

GuardDog risk≥10risk≥5 risk≥7 35.6% · 3.0% FP malcontent criticalcritical+high critical 15.6% · 3.0% FP Atomdrift L0L1000–L2500 L25 6.7% · 0.0% FP VirusTotal n≥6n≥1 n≥4 0.0% · 0.0% FP

Detection and false-positive chart data

Socket hostile: 42.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 4.4% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 17.8% of malware detected as hostile, 3.0% of known-good detected as hostile.
GuardDog risk≥7: 35.6% of malware detected as hostile, 3.0% of known-good detected as hostile (default).
GuardDog risk≥6: 37.8% of malware detected as hostile, 3.0% of known-good detected as hostile.
GuardDog risk≥5: 42.2% of malware detected as hostile, 3.0% of known-good detected as hostile.
SafeDep hostile: 35.6% of malware detected as hostile, 0.0% of known-good detected as hostile.
Aikido Malware hostile: 24.4% of malware detected as hostile, 0.0% of known-good detected as hostile.
malcontent critical: 15.6% of malware detected as hostile, 3.0% of known-good detected as hostile (default).
malcontent critical+high: 53.3% of malware detected as hostile, 6.1% of known-good detected as hostile.
Atomdrift L0: 6.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1: 6.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L5–L10: 6.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L25: 6.7% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
Atomdrift L50: 6.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L100: 11.1% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L250: 13.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L500: 44.4% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1000–L2500: 44.4% of malware detected as hostile, 0.0% of known-good detected as hostile.
ClamAV hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥6: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥5: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥4: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
VirusTotal n≥3: 2.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥2: 4.4% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥1: 6.7% of malware detected as hostile, 0.0% of known-good detected as hostile.

Atomdrift L0L1000–L2500 L25 90.2% · 0.0% FP VirusTotal n≥6n≥1 n≥4 90.2% · 0.0% FP malcontent criticalcritical+high critical 87.8% · 0.0% FP GuardDog risk≥10risk≥5 risk≥7 0.0% · 0.0% FP

Detection and false-positive chart data

Atomdrift L0: 68.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1: 68.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L5–L10: 68.3% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L25: 90.2% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
Atomdrift L50: 90.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L100: 90.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L250: 90.2% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L500: 92.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1000–L2500: 92.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥6: 87.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥5: 87.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥4: 90.2% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
VirusTotal n≥3: 92.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥2: 95.1% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥1: 97.6% of malware detected as hostile, 0.0% of known-good detected as hostile.
malcontent critical: 87.8% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
malcontent critical+high: 90.2% of malware detected as hostile, 30.8% of known-good detected as hostile.
ClamAV hostile: 48.8% of malware detected as hostile, 0.0% of known-good detected as hostile.
Aikido Malware hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥7: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
GuardDog risk≥6: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥5: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
SafeDep hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
Socket hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.

VirusTotal n≥6n≥1 n≥4 76.5% · 0.0% FP Atomdrift L0L1000–L2500 L25 52.9% · 2.4% FP GuardDog risk≥10risk≥5 risk≥7 23.5% · 2.4% FP malcontent criticalcritical+high critical 17.6% · 0.0% FP

Detection and false-positive chart data

VirusTotal n≥6: 64.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥5: 70.6% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥4: 76.5% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
VirusTotal n≥3: 76.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥2: 76.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
VirusTotal n≥1: 76.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
Socket hostile: 64.7% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L0: 47.1% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L1: 47.1% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L5–L10: 47.1% of malware detected as hostile, 0.0% of known-good detected as hostile.
Atomdrift L25: 52.9% of malware detected as hostile, 2.4% of known-good detected as hostile (default).
Atomdrift L50: 52.9% of malware detected as hostile, 2.4% of known-good detected as hostile.
Atomdrift L100: 52.9% of malware detected as hostile, 2.4% of known-good detected as hostile.
Atomdrift L250: 52.9% of malware detected as hostile, 2.4% of known-good detected as hostile.
Atomdrift L500: 52.9% of malware detected as hostile, 2.4% of known-good detected as hostile.
Atomdrift L1000–L2500: 52.9% of malware detected as hostile, 2.4% of known-good detected as hostile.
SafeDep hostile: 52.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
Aikido Malware hostile: 47.1% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥10: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥9: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥8: 23.5% of malware detected as hostile, 0.0% of known-good detected as hostile.
GuardDog risk≥7: 23.5% of malware detected as hostile, 2.4% of known-good detected as hostile (default).
GuardDog risk≥6: 23.5% of malware detected as hostile, 2.4% of known-good detected as hostile.
GuardDog risk≥5: 35.3% of malware detected as hostile, 2.4% of known-good detected as hostile.
malcontent critical: 17.6% of malware detected as hostile, 0.0% of known-good detected as hostile (default).
malcontent critical+high: 35.3% of malware detected as hostile, 17.1% of known-good detected as hostile.
ClamAV hostile: 5.9% of malware detected as hostile, 0.0% of known-good detected as hostile.
malscan hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.
ossgadget-backdoor hostile: 0.0% of malware detected as hostile, 0.0% of known-good detected as hostile.

Each dot is an engine at one setting, plotting what it detects as hostile there; its suspicious detections, counted in the bars above, are not plotted. Defaults: Atomdrift L25 (as shipped), VirusTotal n≥4 (engines agreeing), malcontent critical, GuardDog risk≥7 (its “likely malicious”). Socket, Aikido Malware and SafeDep had no record of any known-good file they could look up, and VirusTotal had a record of 114 of 492. No record counts as not flagged, so those false-positive rates include files the engine never judged.

Run by run last 30 days · detected, hostile or suspicious, as the bars count it

Each point is the malware one run added, scored like the bars above. A sample drawn again within the week counts in the run that first scanned it, so the shaded runs pool to exactly the figures at the top. A fresh cohort every run, so every line swings. Judge us on the worst night, not the best.

False positives

Of 492 known-good samples, Atomdrift detected 2 (0.4%): 2 as hostile (0.4%) and 0 as suspicious (0.0%).

File type	Hostile	Suspicious
go_module	3d5d0a8696b5f086-github.com_apple_swift-v0.0.0-20260915164611-12c84fbacb8a.zip
msi	subhra74-xdm-v9.0.1-pre.3-xdm-9.0.1-x64.msi

isotope13.io: new rules the hour they clear QA, an API, and someone on the hook.

Appendix — samples and methodology all 463, every one linked

What “zero-day” means here. Every detection sample first appeared in the wild less than 48 hours before the run (median 7 h, youngest 1.1 h): too new for reputation or download history to form, and usually for a signature of its own — though one from a known family can still match an older signature, which is why signature engines score at all. Catching malware a feed has already named is a different, easier problem.

How this is scored. Every engine gets the identical cohort, and a skip counts as a miss for everyone — a file nobody scanned is a file nobody detected. The bars count everything an engine detects, down to the setting named beside it; the chart counts what it detects as hostile, one dot per setting. A sample drawn by more than one run in the window counts once, at its first scan. A listing from a contestant's own feed counts only once an independent engine corroborates it. The 492 known-good samples are 246 registry packages, 64 project and vendor downloads and 182 files whose source wasn't recorded, which reached our collection up to 61 days before they were scanned (median 42). Each is re-checked later: one that turns out to be malware is dropped from the false-positive rates, and any engine that flagged it is credited with an early detection. We run this benchmark and we're one of the engines in it, so we publish every sample, verdict and rate.

Engine versions: Atomdrift 2.13.0 · ClamAV 1.5.2 · GuardDog 3.2.0 · malcontent 1.28.0 · ossgadget-backdoor v0.2.38 source-sha256:d7b34b9d836784bcf38fd191f92db9489590916837f4ab39d561167a9cd6440e (VirusTotal, Socket, Aikido Malware, SafeDep are hosted, so unversioned).

Why the cohort isn't a random sample. A plain random draw from the malware and open-source firehoses is dominated by whatever published most: three registries took 70% of the known-good seats and Windows executables 60% of the malware seats, which left most file formats never measured at all. So each cohort is built from two parts. Most seats track the real population, damped by a square root so the biggest format stays the biggest without crowding out everything else. The rest go one-per-format on a rotation, and that rotation is the only reason a Firefox add-on or a Conda package appears here at all. Over the last 7 days: 327 proportional seats and 143 rotation seats on the malware side, across 15 formats.

So every rate is published twice. The bars show the rate over this cohort. Because the cohort over-samples rare formats deliberately, that is not what an engine would score on the population — so each rate is also re-weighted by every format's true share of it.

Weighted to the population (hostile + suspicious): Atomdrift 82.4% · VirusTotal 80.4% · malcontent 73.3% · ClamAV 50.5% · ossgadget-backdoor 17.2% · Aikido Malware 9.6% · GuardDog 9.0% · Socket 5.2% · SafeDep 3.9% · malscan 0.0%.

On the false-positive side they speak for 99%: nothing was drawn for 1, 3, 3avl, 3cc, 3curses, 3dat, 3kstat, 3lib, 3mvec, 3nsl, 3ossl, 3sip, 4fs, 4m, 4p, 5, 7z, 931, 9e, ahd, ahk, apinotes, apk_alpine, apk_android, asmdef, axaml, bar, batch, bz2, cache, cikernel, cnf, cpio, cpl, cran, cube, cvb, dep, dly, dxf, eff, egg, enc, fs, glsl, go, graphql, hook, hwdb, imports, in, inc, jelly, jsonc, la, lfo, list, local, lst, m3u, macho, make, makefile, me, mma, name, npmrc, omo, pbxproj, phs, pkg_arch, policy, ppl, prl, r, reg, reibl, rule, sb, scl, sdir, sealed, seq, sha1, shp, shtml, sln, swf, tab, template, tmac, tmpl, toolbar, tt, twig, url, vars, vcf, vcp, web, winget.

Re-weighting costs precision, so here is the cost: these 470 malware samples carry the statistical weight of 191 once weighted.

Point it at anything.

curl -fsSL https://install.atomdrift.org/scan.sh | sh