ProfMalPlus, a malicious NPM package detector combining object-sensitive behavior graphs with coordinated LLM reasoning over annotated code slices, is proposed, a malicious NPM package detector combining object-sensitive behavior graphs with coordinated LLM reasoning over annotated code slices.
Abstract
Open source software is vulnerable to supply-chain attacks through transitive dependencies, especially malicious code injected into NPM packages. Existing detectors often inadequately model obfuscated behavior, overlook JavaScript's object-centric features, poorly coordinate static and dynamic analysis, and lose semantic information during behavior abstraction. We propose ProfMalPlus, a malicious NPM package detector combining object-sensitive behavior graphs with coordinated LLM reasoning over annotated code slices. It identifies installation commands and entry files, then constructs graphs capturing sensitive APIs, third-party calls, and unresolved calls. From these graphs, ProfMalPlus extracts security-relevant slices and adds inline static analysis evidence. Local judge agents independently assess each slice. Self-consistency consolidates repeated judgements to reduce LLM variance, while a global judge synthesizes their reports into an entry-level verdict. For undetermined cases, a router selects either third-party enrichment, which adds registry derived module and method semantics, or dynamic augmentation, which executes the package in a sandbox to resolve runtime dependent behavior. The enriched evidence is fed back for reassessment. Finally, a localization agent reports malicious code snippets with explanations. ProfMalPlus achieves a 98.1% F1-score, outperforming state-of-the-art detectors by 3.5% to 52.6%. It also identified 597 previously unknown malicious packages, all confirmed and removed from NPM.
With the widespread use of open-source components in modern software development, reusing third-party code improves development efficiency while also intensifying security risks in the software supply chain. As the largest open-source package registry in the world, NPM (Node Package Manager) has become a primary target for supply chain attacks. Existing methods for detecting malicious NPM packages face two main challenges. First, traditional program graphs used to represent source code (e.g., Abstract Syntax Tree (AST) and Call Graph (CG)) have limited capability in characterizing malicious behaviors inside code, thereby affecting analysis efficiency and detection accuracy. Second, matching rules for identifying malicious packages mostly rely on manual definition. This process is time-consuming and labor-intensive, and the accuracy of these rules needs improvement. To address these challenges, this paper proposes the PDCG-RuleDetector framework to detect malicious NPM packages. First, this paper uses the proposed Parameterized Data-flow Call Graph (PDCG) to represent script files in NPM packages, and leverages a Large Language Model (LLM) to automatically extract sensitive behavior matching rules from malicious NPM packages, constructing a sensitive behavior matching rule library. Then, this paper marks sensitive nodes in the PDCG according to the rules in the rule library, generates feature vectors from the PDCG, and trains a classifier to detect malicious NPM packages. The effectiveness of the PDCG-RuleDetector framework is validated on widely used datasets. On the MalnpmDB dataset, the proposed model achieves an F1 score of 96.2%, which is better than existing detection methods. On the Robust and Datadog datasets, the F1 scores are 91.2% and 94.9%, respectively. These results show good generalization capability. More importantly, during 10 days of real-world deployment, the framework identified 152 malicious packages among 107,802 newly published NPM packages. All of them were verified and removed by the official NPM security team.
He Bai, Jia-Qi Zhang, Honghui Li et al.· Journal of King Saud Univers...· 0 citations
SafeFlow is proposed, a defense framework for multi-agent systems that formalizes malicious cross-agent propagation as a semantic information-flow problem and reduces attack success rates compared to undefended baselines and external defenses while retaining high benign task completion and a high paired safe--harm success rate.
Haowen Dai, Zonghao Ying, Wenfeng Li et al.· arXiv.org· 0 citations
ContainmentBench, a sandboxed benchmark comprising a 504-scenario specification dataset, a shared rollout-trace schema, and stage-scoped metrics for endpoint violations, logged propagation, and explicitly authorized taint-exposed proposals that commit, is introduced.
Wen-Hao Lan, Shan Li, Meiqi Wu et al.· 0 citations
Agent Skills extend LLM agents with reusable instruction packages that may also include scripts, resources, and service configuration. This creates a direct distribution channel for malicious behavior, yet existing malicious-Skill datasets are fragmented across sources, artifact formats, evidence regimes, and benign coverage; duplicated and structurally related content further complicates direct aggregation and evaluation. We present MaliciousSkillBench, a comprehensive benchmark for malicious Agent Skill detection. We consolidate 13 public sources, 11 of which contribute Core malicious artifacts, and reduce 8,414 raw malicious records to 7,539 normalized-unique identities in 4,588 operational structural families. After conservative cross-label conflict exclusion, the primary benchmark contains 9,740 Skills: 7,505 malicious and 2,235 benign. To characterize its coverage, we harmonize 11 attack categories for 4,983 malicious identities with supported source-native mappings and find substantial differences in threat composition across sources. We then evaluate three learned text detectors and three off-the-shelf Skill scanners. Learned detectors achieve 0.882-0.932 Random Macro-F1 but only 0.653-0.665 under Source-Disjoint evaluation; the strongest word TF-IDF SVM scores 0.932/0.916/0.665 on Random/structural-disjoint/Source-Disjoint while retaining 95.6% malicious recall but producing 62.4% benign FPR on held-out sources. Off-the-shelf scanners occupy different but also unsatisfactory operating regimes, reducing false positives only at the cost of sharply lower malicious recall. Together, these results show that reliable malicious-Skill detection requires both broader cross-source benchmark coverage and evaluation that jointly measures attack detection and benign over-flagging.
Ethereum non-fungible tokens (NFTs) implement ownership, transfer, authorization, and metadata operations through smart contracts, making contract vulnerabilities a direct risk to digital assets. Existing static analyzers provide efficient rule-based screening but can struggle with application-specific logic, whereas unconstrained large language model analysis may be distracted by irrelevant code or produce inconsistent outputs. We present a vulnerability-detection method that combines vulnerability-focused code slicing, an ERC-721-oriented knowledge base, and constrained DeepSeek analysis. Regular-expression patterns locate candidate statements for reentrancy, integer overflow or underflow, and timestamp dependence. A structure-aware context-window algorithm then extracts line-numbered code slices. DeepSeek analyzes each slice using explicit decision rules and a fixed output schema, and the resulting records support automated batch processing. On 450 NFT contract samples, the full configuration produced 437 positive labels, corresponding to a reported positive-label rate of 97.1%. Removing the external knowledge base reduced this rate to 87.11%, while analyzing complete contracts without the knowledge base reduced it to 73.78%. These results indicate that focused code context and domain constraints materially affect the detector's reported output.
