Malware Scanner Battle Royale
Every run pulls the newest known-bad and known-good packages from live threat feeds and scans them with every engine — same samples, ground-truth labels. Last updated 2026-07-09 (50 malware · 50 benign).
| Provider | License | App code | Vendored code | Dependencies | Binaries | Air-gap | Registries |
|---|---|---|---|---|---|---|---|
| Atomdrift | Apache-2.0 | ✓ | ✓ | ✓ | ✓ | ✓ | 47 |
| Aikido Malware | Subscription | ✗ | ✗ | ✓ | ✗ | ✗ | 18 |
| Socket | Subscription | ✗ | ✗ | ✓ | ✗ | ✗ | 11 |
| GuardDog by Datadog | Apache-2.0 | ✗ | ✓ | ✓ | ✗ | ✗ | 5 |
| malcontent | Apache-2.0 | ✓ | ✓ | ✗ | ✓ | ✓ | — |
| ClamAV | GPLv2 | ✗ | ✓ | ✗ | ✓ | ✓ | — |
What each engine is built to scan — detection scores are below.
Detected malware
Across 50 recent samples flagged by OSV, OSM, and other threat feeds.
Flagged hostile
Flagged suspicious
Atomdrift
48%
Socket
44%
Aikido Malware
30%
GuardDog by Datadog
16%
malcontent
8%
ClamAV
0%
Coverage — what each engine can scan
Share of this run's files each engine can analyze (by file type and registry) — coverage, not detection. Longer is broader.
Atomdrift
85%
malcontent
67%
Aikido Malware
51%
Socket
30%
GuardDog by Datadog
29%
ClamAV
14%
False positives — flagged good packages
Across 50 known-good packages — any flag is a false alarm. Shorter is better; empty is perfect.
Flagged hostile
Flagged suspicious
malcontent
12%
Atomdrift
6%
GuardDog by Datadog
4%
Aikido Malware
0%
ClamAV
0%
Socket
0%
Detection by ecosystem
Catch rate within each ecosystem, over the samples each engine can scan there.
GitHub 19 samples
Atomdrift
5%
malcontent
5%
Aikido Malware
0%
ClamAV
0%
GuardDog by Datadog
0%
Socket
0%
JavaScript 19 samples
Socket
89%
Atomdrift
79%
Aikido Malware
68%
GuardDog by Datadog
26%
ClamAV
0%
malcontent
0%
Browser Extensions 4 samples
Atomdrift
75%
Aikido Malware
25%
ClamAV
0%
GuardDog by Datadog
0%
malcontent
0%
Socket
0%
Python 3 samples
Atomdrift
100%
Socket
100%
GuardDog by Datadog
67%
Aikido Malware
0%
ClamAV
0%
malcontent
0%
Containers 1 sample
malcontent
100%
Atomdrift
100%
Aikido Malware
0%
ClamAV
0%
GuardDog by Datadog
0%
Socket
0%
Go 1 sample
malcontent
100%
GuardDog by Datadog
100%
Socket
100%
Aikido Malware
0%
Atomdrift
0%
ClamAV
0%
Linux/BSD 1 sample
Aikido Malware
0%
Atomdrift
0%
ClamAV
0%
GuardDog by Datadog
0%
malcontent
0%
Socket
0%
Other 1 sample
malcontent
100%
Aikido Malware
0%
Atomdrift
0%
ClamAV
0%
GuardDog by Datadog
0%
Socket
0%
Rust 1 sample
Aikido Malware
100%
Atomdrift
100%
Socket
100%
ClamAV
0%
GuardDog by Datadog
0%
malcontent
0%
Detection over time
Each engine's catch rate on known malware, run over run — higher and steadier is better. Click a name to isolate it.
Methodology
- Known-bad packages are pulled from live threat feeds. Independent feeds are trusted as-is — a bogus listing just makes every engine miss it equally. But a listing from a feed that is also a contestant (Socket, Aikido Malware, GuardDog by Datadog) is kept only when an independent engine corroborates it, so no one is credited for its own possibly-spurious self-report.
- Known-good packages are recent releases presumed benign — curated good feeds plus newly-published packages; any flag against them, hostile or suspicious, is a false positive.
- Each engine's native severity is normalised to four tiers — hostile, suspicious, benign, unsupported. A sample is caught (on known-bad) or a false alarm (on known-good) when it's flagged hostile or suspicious; the bars stack the two shades, darker for hostile.
- Rates are taken over what each engine can actually scan: a sample it skips — unsupported ecosystem or file type — drops from the denominator, but a sample it errors on still counts as a miss.
- This is preliminary: the corpus is small and refreshed continuously, and the known-bad set is still being widened. Numbers will move.
Engine versions: Atomdrift 2.3.0-beta.0 · ClamAV 1.5.2 · GuardDog by Datadog 3.1.0 (local engines; Socket and Aikido Malware are hosted; OSV/OSM are live feeds)
Reference data — 50 known-malware + 50 known-good files (+3 skipped), scanned 2026-07-09
● Known malware — pulled from threat feeds and corroborated; every detection benchmark number comes from these
● Known good — vetted packages; any hostile flag here is a false positive
⊘ Skipped — provider-reported, uncorroborated — self-published by Socket, Aikido Malware or GuardDog by Datadog but not independently corroborated (no other engine flagged them hostile, and fewer than two flagged them at all), so they're dropped from the detection cohort rather than crediting the reporter for a possibly spurious listing. Independent threat-feed listings are trusted as-is and never dropped — a bogus one just makes every engine miss equally
| Package | Reported by | Socket | Atomdrift | Aikido Malware | GuardDog by Datadog | malcontent | ClamAV |
|---|---|---|---|---|---|---|---|
| pkg:golang/github.com/praetorian-inc/[email protected] | Socket | S | B | B | S | H | B |
| pkg:npm/@duckmind/[email protected] | Socket | S | S | B | B | S | B |
| pkg:npm/@bleedingdev/[email protected] | Socket | S | B | B | S | B | B |
Coverage gaps — what each engine couldn't analyze: whole packages skipped for an unsupported ecosystem, or file types it can't read within a supported one
| Provider | Skipped ecosystems | Unscannable file types |
|---|---|---|
| Atomdrift | - | unknown (321 files), yaml (168 files), crt (130 files), md5sums (113 files), list (107 files), shlibs (59 files), pak (59 files), map (45 files), conf (38 files), html (36 files), gitignore (30 files), 0 (29 files), 1 (27 files), 3 (26 files), 2 (25 files), 4 (22 files), conffiles (22 files), ico (21 files), 5 (20 files), yml (20 files), bats (20 files), 7 (18 files), 6 (17 files), 8 (17 files), handlebars (17 files), 9 (15 files), 10 (15 files), 11 (14 files), 12 (14 files), lz4 (14 files), 13 (11 files), templates (9 files), avif (8 files), tsv (8 files), log (8 files), dsh-also (7 files), 14 (6 files), astro (6 files), gpg (6 files), timer (6 files), p7s (6 files), 15 (5 files), prettierrc (5 files), webp (5 files), ttf (5 files), woff (5 files), triggers (5 files), jsonl (4 files), toml (4 files), example (4 files), manifest (4 files), mf (4 files), rsa (4 files), sf (4 files), sig (4 files), woff2 (4 files), pdb (4 files), rst (4 files), babelrc (3 files), lgtm (3 files), opts (3 files), eot (3 files), cfg (3 files), bcc (3 files), il (3 files), xpm (3 files), prettierignore (2 files), backup (2 files), csv (2 files), graphifyignore (2 files), prisma (2 files), cache (2 files), dat-old (2 files), master (2 files), in (2 files), pem (2 files), msvc (2 files), 16 (1 files), 17 (1 files), orig (1 files), dockerignore (1 files), codes (1 files), encoding (1 files), template (1 files), webmanifest (1 files), code-workspace (1 files), dict (1 files), glb (1 files), mp3 (1 files), lock (1 files), npmrc (1 files), apt (1 files), blacklist (1 files), cnf (1 files), com_ubuntu_dists_jammy-backports_inrelease (1 files), com_ubuntu_dists_jammy-security_inrelease (1 files), com_ubuntu_dists_jammy-updates_inrelease (1 files), com_ubuntu_dists_jammy_inrelease (1 files), dafsa (1 files), defs (1 files), dir (1 files), findutils (1 files), minix (1 files), net (1 files), profile (1 files), rules (1 files), users-and-groups (1 files), wget-hsts (1 files), xterm-256color (1 files), typed (1 files), filters (1 files), sln (1 files), traineddata (1 files), 10beta2 (1 files), 10rc1 (1 files), 10rc2 (1 files), 11beta2 (1 files), 11beta3 (1 files), 11rc1 (1 files), 11rc2 (1 files), 12beta1 (1 files), 12beta2 (1 files), 12rc1 (1 files), 13beta1 (1 files), 13rc1 (1 files), 13rc2 (1 files), 14beta1 (1 files), 14rc1 (1 files), 15beta1 (1 files), 15rc2 (1 files), 16beta1 (1 files), 17beta1 (1 files), 17rc1 (1 files), 17rc2 (1 files), 18beta1 (1 files), 18beta2 (1 files), 18rc1 (1 files), 19beta1 (1 files), 20rc1 (1 files), 20rc2 (1 files), 3beta1 (1 files), agignore (1 files), editorconfig (1 files), gitattributes (1 files), ogg (1 files), webm (1 files), gitkeep (1 files), skills-config (1 files), 4rc (1 files), 7rc (1 files), br (1 files), enc (1 files), orc (1 files), parquet (1 files), cmake (1 files), owc (1 files), rc (1 files), ru (1 files), car (1 files), icns (1 files), nib (1 files), mp4 (1 files), tsbuildinfo (1 files), ps1xml (1 files), coveragerc (1 files), flake8 (1 files), ini (1 files) |
| malcontent | - | markdown (719 files), text (366 files), unknown (321 files), json (301 files), png (222 files), yaml (168 files), registry (150 files), package.json (134 files), crt (130 files), md5sums (113 files), list (107 files), svg (83 files), shlibs (59 files), pak (59 files), map (45 files), xml (39 files), conf (38 files), html (36 files), github_actions (35 files), jpeg (32 files), kotlin (31 files), gitignore (30 files), 0 (29 files), 1 (27 files), 3 (26 files), 2 (25 files), 4 (22 files), conffiles (22 files), ico (21 files), package-lock.json (21 files), 5 (20 files), yml (20 files), bats (20 files), 7 (18 files), plist (18 files), 6 (17 files), 8 (17 files), handlebars (17 files), 9 (15 files), 10 (15 files), 11 (14 files), 12 (14 files), lz4 (14 files), pkg_info (12 files), 13 (11 files), systemd_service (11 files), chrome-manifest (9 files), templates (9 files), avif (8 files), makefile (8 files), tsv (8 files), log (8 files), dsh-also (7 files), 14 (6 files), astro (6 files), data (6 files), gpg (6 files), timer (6 files), p7s (6 files), 15 (5 files), pnpm-lock.yaml (5 files), dockerfile (5 files), prettierrc (5 files), webp (5 files), ttf (5 files), woff (5 files), triggers (5 files), go.mod (4 files), jsonl (4 files), toml (4 files), example (4 files), manifest (4 files), mf (4 files), rsa (4 files), sf (4 files), sig (4 files), woff2 (4 files), src_info (4 files), pdb (4 files), rst (4 files), babelrc (3 files), lgtm (3 files), opts (3 files), eot (3 files), cfg (3 files), ruby (3 files), bcc (3 files), il (3 files), xpm (3 files), rust (2 files), prettierignore (2 files), backup (2 files), csv (2 files), go.sum (2 files), graphifyignore (2 files), requirements.txt (2 files), prisma (2 files), cache (2 files), dat-old (2 files), master (2 files), in (2 files), pem (2 files), msvc (2 files), 16 (1 files), 17 (1 files), cargo.lock (1 files), cargo.toml (1 files), orig (1 files), dockerignore (1 files), codes (1 files), encoding (1 files), template (1 files), webmanifest (1 files), code-workspace (1 files), dict (1 files), glb (1 files), mp3 (1 files), lock (1 files), npmrc (1 files), apt (1 files), blacklist (1 files), cnf (1 files), com_ubuntu_dists_jammy-backports_inrelease (1 files), com_ubuntu_dists_jammy-security_inrelease (1 files), com_ubuntu_dists_jammy-updates_inrelease (1 files), com_ubuntu_dists_jammy_inrelease (1 files), dafsa (1 files), defs (1 files), dir (1 files), findutils (1 files), minix (1 files), net (1 files), pdf (1 files), profile (1 files), rules (1 files), users-and-groups (1 files), wget-hsts (1 files), xterm-256color (1 files), typed (1 files), filters (1 files), sln (1 files), traineddata (1 files), 10beta2 (1 files), 10rc1 (1 files), 10rc2 (1 files), 11beta2 (1 files), 11beta3 (1 files), 11rc1 (1 files), 11rc2 (1 files), 12beta1 (1 files), 12beta2 (1 files), 12rc1 (1 files), 13beta1 (1 files), 13rc1 (1 files), 13rc2 (1 files), 14beta1 (1 files), 14rc1 (1 files), 15beta1 (1 files), 15rc2 (1 files), 16beta1 (1 files), 17beta1 (1 files), 17rc1 (1 files), 17rc2 (1 files), 18beta1 (1 files), 18beta2 (1 files), 18rc1 (1 files), 19beta1 (1 files), 20rc1 (1 files), 20rc2 (1 files), 3beta1 (1 files), agignore (1 files), editorconfig (1 files), gitattributes (1 files), ogg (1 files), webm (1 files), gitkeep (1 files), skills-config (1 files), 4rc (1 files), 7rc (1 files), br (1 files), enc (1 files), orc (1 files), parquet (1 files), cmake (1 files), yarn.lock (1 files), owc (1 files), rc (1 files), ru (1 files), asar (1 files), car (1 files), icns (1 files), nib (1 files), mp4 (1 files), tsbuildinfo (1 files), ps1xml (1 files), coveragerc (1 files), flake8 (1 files), ini (1 files), pyproject.toml (1 files) |
| Aikido Malware | container (2733 files), freebsd (775 files), macos (470 files), vendor (120 files), wolfi (81 files), perl (15 files), powershell (13 files), arch (11 files), windows (7 files), openclaw (4 files) | json (292 files), text (285 files), png (221 files), yaml (161 files), registry (144 files), svg (83 files), pe (42 files), html (33 files), unknown (33 files), jpeg (32 files), gitignore (28 files), xml (27 files), map (22 files), ico (20 files), handlebars (17 files), yml (15 files), macho (14 files), avif (8 files), tsv (8 files), astro (6 files), p7s (6 files), dockerfile (5 files), prettierrc (5 files), webp (5 files), ttf (5 files), woff (5 files), jsonl (4 files), makefile (4 files), toml (4 files), example (4 files), manifest (4 files), mf (4 files), rsa (4 files), sf (4 files), sig (4 files), woff2 (4 files), pdb (4 files), crt (4 files), log (3 files), babelrc (3 files), lgtm (3 files), opts (3 files), eot (3 files), gz (3 files), rst (3 files), prettierignore (2 files), backup (2 files), csv (2 files), graphifyignore (2 files), wasm (2 files), prisma (2 files), pem (2 files), orig (1 files), zip (1 files), dockerignore (1 files), codes (1 files), encoding (1 files), template (1 files), webmanifest (1 files), code-workspace (1 files), dict (1 files), glb (1 files), mp3 (1 files), lock (1 files), npmrc (1 files), typed (1 files), systemd_service (1 files), traineddata (1 files), ogg (1 files), webm (1 files), gitkeep (1 files), skills-config (1 files), 4rc (1 files), 7rc (1 files), br (1 files), bz2 (1 files), cfg (1 files), enc (1 files), in (1 files), orc (1 files), parquet (1 files), zst (1 files), tar.gz (1 files), mp4 (1 files), tsbuildinfo (1 files) |
| Socket | container (2733 files), github (2259 files), freebsd (775 files), macos (470 files), firefox (401 files), vendor (120 files), wolfi (81 files), perl (15 files), powershell (13 files), arch (11 files), windows (7 files), openclaw (4 files) | markdown (621 files), json (223 files), yaml (160 files), text (140 files), png (77 files), registry (48 files), pe (42 files), unknown (27 files), xml (27 files), map (22 files), html (17 files), handlebars (17 files), macho (14 files), yml (11 files), tsv (8 files), ico (6 files), p7s (6 files), gitignore (4 files), jsonl (4 files), makefile (4 files), svg (4 files), pdb (4 files), crt (4 files), dockerfile (3 files), babelrc (3 files), lgtm (3 files), opts (3 files), gz (3 files), rst (3 files), backup (2 files), csv (2 files), graphifyignore (2 files), jpeg (2 files), pem (2 files), orig (1 files), wasm (1 files), codes (1 files), encoding (1 files), template (1 files), webmanifest (1 files), typed (1 files), systemd_service (1 files), traineddata (1 files), gitkeep (1 files), skills-config (1 files), 4rc (1 files), 7rc (1 files), br (1 files), bz2 (1 files), cfg (1 files), enc (1 files), in (1 files), orc (1 files), parquet (1 files), zst (1 files), tar.gz (1 files) |
| GuardDog by Datadog | container (2733 files), github (2259 files), freebsd (775 files), macos (470 files), firefox (401 files), chrome (192 files), vendor (120 files), dotnet (97 files), wolfi (81 files), perl (15 files), powershell (13 files), arch (11 files), windows (7 files), rust (6 files), openclaw (4 files) | markdown (618 files), yaml (160 files), text (127 files), json (104 files), png (54 files), registry (37 files), unknown (26 files), map (20 files), handlebars (17 files), macho (12 files), yml (11 files), html (10 files), tsv (8 files), ico (6 files), gitignore (4 files), jsonl (4 files), makefile (4 files), crt (4 files), dockerfile (3 files), babelrc (3 files), lgtm (3 files), opts (3 files), gz (3 files), rst (3 files), backup (2 files), csv (2 files), graphifyignore (2 files), jpeg (2 files), pem (2 files), pe (1 files), wasm (1 files), codes (1 files), encoding (1 files), svg (1 files), template (1 files), webmanifest (1 files), typed (1 files), systemd_service (1 files), gitkeep (1 files), skills-config (1 files), 4rc (1 files), 7rc (1 files), br (1 files), bz2 (1 files), cfg (1 files), enc (1 files), in (1 files), orc (1 files), parquet (1 files), zst (1 files), tar.gz (1 files) |
| ClamAV | - | javascript (3315 files), go (1611 files), perl (747 files), markdown (719 files), python (545 files), c (466 files), shell (357 files), unknown (321 files), json (301 files), yaml (168 files), registry (150 files), package.json (134 files), crt (130 files), md5sums (113 files), list (107 files), shlibs (59 files), pak (59 files), map (45 files), xml (39 files), conf (38 files), github_actions (35 files), kotlin (31 files), gitignore (30 files), 0 (29 files), 1 (27 files), 3 (26 files), 2 (25 files), 4 (22 files), conffiles (22 files), ico (21 files), package-lock.json (21 files), 5 (20 files), yml (20 files), bats (20 files), 7 (18 files), plist (18 files), 6 (17 files), 8 (17 files), handlebars (17 files), 9 (15 files), 10 (15 files), 11 (14 files), 12 (14 files), lz4 (14 files), pkg_info (12 files), 13 (11 files), systemd_service (11 files), chrome-manifest (9 files), templates (9 files), avif (8 files), makefile (8 files), tsv (8 files), log (8 files), dsh-also (7 files), 14 (6 files), astro (6 files), data (6 files), gpg (6 files), timer (6 files), p7s (6 files), 15 (5 files), pnpm-lock.yaml (5 files), dockerfile (5 files), prettierrc (5 files), webp (5 files), ttf (5 files), woff (5 files), triggers (5 files), powershell (5 files), go.mod (4 files), jsonl (4 files), toml (4 files), example (4 files), batch (4 files), manifest (4 files), mf (4 files), rsa (4 files), sf (4 files), sig (4 files), woff2 (4 files), src_info (4 files), pdb (4 files), rst (4 files), babelrc (3 files), lgtm (3 files), opts (3 files), eot (3 files), cfg (3 files), ruby (3 files), bcc (3 files), il (3 files), xpm (3 files), rust (2 files), prettierignore (2 files), backup (2 files), csv (2 files), go.sum (2 files), graphifyignore (2 files), requirements.txt (2 files), prisma (2 files), cache (2 files), dat-old (2 files), master (2 files), in (2 files), pem (2 files), msvc (2 files), 16 (1 files), 17 (1 files), cargo.lock (1 files), cargo.toml (1 files), orig (1 files), dockerignore (1 files), codes (1 files), encoding (1 files), template (1 files), webmanifest (1 files), code-workspace (1 files), dict (1 files), glb (1 files), mp3 (1 files), lock (1 files), npmrc (1 files), apt (1 files), blacklist (1 files), cnf (1 files), com_ubuntu_dists_jammy-backports_inrelease (1 files), com_ubuntu_dists_jammy-security_inrelease (1 files), com_ubuntu_dists_jammy-updates_inrelease (1 files), com_ubuntu_dists_jammy_inrelease (1 files), dafsa (1 files), defs (1 files), dir (1 files), findutils (1 files), minix (1 files), net (1 files), pdf (1 files), profile (1 files), rules (1 files), users-and-groups (1 files), wget-hsts (1 files), xterm-256color (1 files), typed (1 files), applescript (1 files), filters (1 files), sln (1 files), traineddata (1 files), 10beta2 (1 files), 10rc1 (1 files), 10rc2 (1 files), 11beta2 (1 files), 11beta3 (1 files), 11rc1 (1 files), 11rc2 (1 files), 12beta1 (1 files), 12beta2 (1 files), 12rc1 (1 files), 13beta1 (1 files), 13rc1 (1 files), 13rc2 (1 files), 14beta1 (1 files), 14rc1 (1 files), 15beta1 (1 files), 15rc2 (1 files), 16beta1 (1 files), 17beta1 (1 files), 17rc1 (1 files), 17rc2 (1 files), 18beta1 (1 files), 18beta2 (1 files), 18rc1 (1 files), 19beta1 (1 files), 20rc1 (1 files), 20rc2 (1 files), 3beta1 (1 files), agignore (1 files), editorconfig (1 files), gitattributes (1 files), ogg (1 files), webm (1 files), gitkeep (1 files), skills-config (1 files), 4rc (1 files), 7rc (1 files), br (1 files), enc (1 files), orc (1 files), parquet (1 files), cmake (1 files), yarn.lock (1 files), owc (1 files), rc (1 files), ru (1 files), asar (1 files), car (1 files), icns (1 files), nib (1 files), mp4 (1 files), tsbuildinfo (1 files), ps1xml (1 files), coveragerc (1 files), flake8 (1 files), ini (1 files), pyproject.toml (1 files) |