experimental
isomer
The version string says nothing changed; the behavior says otherwise.
isomer judges whether a change is malicious. Give it two states of the same thing, a directory, a git ref, a package, or a container image, and it reads the delta in context: capability drift, whether the version bump matches the size of the change, what the commit claims to do, and what the disassembly says it does. “Gained network and process-spawn between 1.2.3 and 1.2.4, and the changelog says fix typo” is a sharper alert than any score on a whole tree. It is also the exact shape of xz-utils, event-stream, and ua-parser-js.
cleave extracts what each side can actually do. An expert system built from three decades of real supply-chain attacks, written up in our public compendium, judges the drift. That is how it can flag a backdoor nobody has seen before, from behavior alone, with no signature. Offline CLI built for CI, powered by Atomdrift Scan. Apache-2.0, no telemetry.
Heavy development
isomer is an early build. Verdicts, flags, and output formats change without notice. Try it, break it, file issues. Do not wire it into anything you cannot unwire. May eat your cat.
Design partners wanted
We want a handful of design partners: teams who will run isomer against real pipelines and real dependency churn and tell us early whether we are building the right thing. Contact Thomas Stromberg at t, at this domain.
The xz-utils test
The benchmark is the hardest version of the problem: the compiled,
stripped liblzma.so from the 2024 xz-utils backdoor. The
5.4.5 → 5.6.0 diff verdicts HOSTILE. With
every known signature ignored, the behavioral axis alone still fails CI,
which is what catching a novel xz-shaped attack on release day
requires. The 5.6.0 → 5.6.3 diff reads as the backdoor
being removed, not added.
Surface
isomer ci # zero-config in CI: derives base..head from the environment isomer fs <old-path> <new-path> # compare two trees; follows the dependency graph isomer git --repo <url> <old> <new> # compare two commits/branches/tags of a remote repo (planned) isomer purl <purl@a> <purl@b> # compare two published package versions (planned) isomer oci <old-image> <new-image> # compare two container images (planned)
ci and fs are implemented. Output is
terminal, JSON, SARIF, or Markdown. Old, then new, like diff.
Exit codes: 0 clean, 1 findings at or above --fail-on,
2 operational error, never confused with findings.
Install
Prebuilt binaries for macOS (signed and notarized) and Linux are on the releases page.
From source (Rust 1.94+):
git clone https://github.com/atomdrift-project/isomer.git cd isomer make install