← Feed

Posts

• Post #4443485

  How much disk space does it take to reliably track & scan all the important open-source software releases published throughout the year? About 120TB. Thanks to #FreeBSD, #ZFS, #WesternDigital, and #Ampere for being awesome. :)

• Post #4063565

  I've been trying to stay quiet about it over vacation, but I'm damned impressed with how #atomdrift is showing up in the malware detection charts. Nothing comes close to it for #supplychainsecurity. Have a question? Leave a comment.

• Post #3621902

  Things are not looking so good for the Linux box that serves the #atomdrift API for serving, foraging, and generally managing sample files. Definitely a shame to be 7000km away from the power button for the next 3 weeks, as it doesn't respond to soft reboot requests. Kinda wish I'd gotten around to enabling remote ZFS snapshots before I left. 🤦

• Post #3251032

  Most malicious #npm packages steal; #express-timer just deletes your source tree a minute after you install it — and its author fumbled their own online-banking password into the very same tarball; just wow. It's trivially detectable using existing open-source software too: https://atomdrift.org/discoveries/2026/06/express-timer-self-destruct-wiper/

• Post #3251031

  With #atomdrift - we're detecting a dozen new supply-chain attacks every day; on-par with the commercial vendors. Most are boring, but some are brazen - this attempt at a CDN-distributed #cryptojacker is the latter: https://atomdrift.org/discoveries/2026/06/v018-axios-cdntest-c-is-for-cookie/

• Post #3251030

  After being locked away for 10+ years in the Cloud; it's so refreshing, and frustrating to deal with all of the little things; like filesystems, database replication and locks, replacing fans and NICs, debugging OOMs, and crashing daemons on #FreeBSD, #OmniOS, and #Linux; I feel like everything moves a little more slowly and sustainably this way; but most of all - I really missed getting lost in the details.

• Post #3148403

  One of my favorite features with #atomdrift's approach to supply-chain attack decomposition is the ability to quickly find other samples using the same techniques by clicking on the #malecule - our custom hash based on a program's behavioral profile. This NPM was uploaded just a few minutes ago, but matches many attacks we've seen throughout the last month.

• Post #3148402

  New day, new silly malware samples found - this time it's PyPI's turn: https://atomdrift.org/discoveries/2026/06/spadata-roblox-cookie-stickup/

• Post #3148401

  The best part of being a solo-founder is the ability to take guilt-free thinking rides. It gave me the clarity on what I'd like to ship next for #atomdrift - JSON trait context, improved lab interface, and a --second-opinion option for (local but non-deterministic) LLM assistance. Coming to #litmus soon!

• Post #3148399

  Epic; thanks for the laugh guys!

• Post #3061440

  I rode my #Experia to a bar this evening to get some fresh air and meet up with the local #motorcycle community. While there, I met a guy with a nice Harley V-Rod, drinking a beer, who explained he's back riding after breaking his leg last year. How'd he break it? Skidded out, leaving this very bar after having too much to drink. In the US, 40% of motorcycle fatalities involve the rider consuming alcohol. Every time I go to a motorcycle meetup at a bar, it feels like a Darwin Awards con...

• Post #3010644

  After being hosed by #btrfs on #linux 7.0.1, the #atomdrift postgresql master database is on #OmniOS & #ZFS It's good to be back, even if I'm rusty in Solaris-based environments.

• Post #2547844

  I'm having too much fun with these slides for #Cackalackycon :)

• Post #2415545

  A close friend just asked me to recover data from a Mac. No problem I said; it turns out it's a PowerMac G5. I used to have one myself - 20+ years ago. I don't have any DVD-R media, so what's the best USB boot environment for these things? YDL is dead, so Linux looks... tricky.

• Post #2312489

  I just realized I'm now sitting here with 3TB of #malware on my computer - what could possibly go wrong?

• Post #2189172

  Our latest #opensource drop: https://github.com/chainguard-dev/acls-in-yaml As part of #SOC2 #compliance, we've been using this to run monthly #audit reviews of our ACLs across SaaS platforms: #GCP, #Slack, #Vercel, etc. acls-in-yaml dumps #ACLs from each platform into a consistent and neutral #YAML format, which makes it easy to visualize change over time. We use this by committing the result into a #Github repo and getting the PR reviewed by the admins for each system. PS: ACL c...

• Post #1851393

  cleave v1.2.0 is now available! cleave is the successor to malcontent - decomposing a program into a set of MBC/ATT&CK-aligned features useful for security engineers and ML pipelines alike. The screenshot is how cleave sees an ELF #malware sample that was dropped just yesterday. Using both AST and automated reverse engineering [rizin], cleave executes 50,000+ rules across 75 file formats. Project: https://codeberg.org/atomdrift/cleave

• Post #1714990

  https://codeberg.org/atomdrift/stng - my wild strings(1) replacement for security engineers has a shiny new release (v1.2.0): * New arm64 stack-XOR decoder for macOS malware * Fewer false positives for IPv4 constants * 66% faster XOR scanning

• Post #1436664

  At the risk of spilling the beans too early... I grew tired of the constant barrage of supply-chain attacks afflicting the open-source community and decided to create a new open-source #malware scanner, named #Litmus. This is part of a larger vision for intercepting supply-chain attacks, called The #Atomdrift Project. I want to empower everyone, from software marketplaces to teenagers at home, to catch the sorts of attacks we've recently seen against #Trivy and #OpenClaw.

• Post #610345

  New blog post outlining some of the #infosec #detection techniques we use with #osquery, specifically against the most interesting new macOS malware of the past year: https://unfinished.bike/behavioral-detection-of-macos-malware-using-osquery

• Post #380008

  After using it in the real world for some time, stng v1.0.0 is now ready for the world. If you regularly use the strings(1) command, you really have to give this a try: https://codeberg.org/HEXXDECIMAL/stng AFAIK, it handles strings from Rust & Go binaries better than anyone in the biz. Also automatically finds & decodes XOR, base64, base58, and RC4 encrypted/encoded data. #malware