MalTotal leverages LLM-assisted semantic reasoning to identify sensitive APIs, perform hybrid semantic slicing, and reconstruct malicious behavior contexts while reducing analysis overhead, demonstrating the effectiveness, scalability, and cost-efficiency of MalTotal in mitigating large-scale code poisoning attacks.
Abstract
The widespread adoption of open source software (OSS) has introduced significant security risks, with malicious code poisoning attacks increasingly targeting public package registries and open-source platforms. Existing detection approaches, including heuristic-, learning-, and LLM-based methods, suffer from language-specific designs, limited generalization, and high analysis costs, making them unsuitable for large-scale multi-language analysis. To address these challenges, we propose MalTotal, a scalable and cost-effective framework for language-agnostic malicious code detection. MalTotal leverages LLM-assisted semantic reasoning to identify sensitive APIs, perform hybrid semantic slicing, and reconstruct malicious behavior contexts while reducing analysis overhead. Our evaluations show that MalTotal outperforms 8 state-of-the-art baselines, achieving an average F1-score of 93.1% across 5 mainstream languages. Its hybrid slicing reduces LLM token consumption by 94.0%, lowering the analysis cost from \$86.25 to \$5.19 on 2,168 repositories. In a large-scale study of 120K GitHub repositories containing over 7.3 million files, MalTotal discovered 564 previously unknown malicious repositories across multiple languages at a total cost of \$338. These results demonstrate the effectiveness, scalability, and cost-efficiency of MalTotal in mitigating large-scale code poisoning attacks.
This paper introduces a programming language-agnostic, transferable, adversarial attack that exploits this CLM vulnerability and demonstrates that this attack, even when computed using smaller code embedding models, is highly effective and transferable to larger, closed-source embedding models.
Kaicheng Wang, Liyan Huang, Jesse Thomason et al.· 0 citations
Static analysis remains a cornerstone of software security, yet the effectiveness of tools such as CodeQL is often limited by the substantial manual effort required to develop high-coverage query suites. While large language models (LLMs) have emerged as a potential solution for automated code reasoning, their practical utility in generating structured, executable security queries remains underexplored. In this paper, we conduct an empirical study to evaluate the ability of LLMs to synthesize CodeQL queries using vulnerability data from the National Vulnerability Database. Through this investigation, we explore the potential of using LLMs as an automatic CodeQL query generator. Subsequently, we systematically evaluate the performance of various LLM architectures across a diverse set of real-world vulnerabilities, measuring their ability to improve detection coverage and precision. Our findings reveal that LLM-generated queries significantly enhance the baseline CodeQL queries, yielding 82% improvement in average F1-score. Furthermore, we provide a detailed cost- benefit analysis showing that while direct LLM-based scanning of entire repositories is often computationally and financially prohibitive, leveraging LLMs to synthesize CodeQL queries offers a scalable and cost-effective alternative for large-scale vulnerability detection. Our results suggest that LLMs can effectively bridge the gap between unstructured vulnerability reports and formal static analysis specifications, offering a scalable path toward comprehensive automated vulnerability detection.
I. Irsan, Ratnadira Widyasari, Huihui Huang et al.· 0 citations
The application of LLMs for detecting malicious PowerShell scripts and producing human-interpretable explanations for their classification decisions are investigated, showing that LLMs are capable of identifying and explaining malicious PowerShell scripts, although performance varies across different models.
Meng Wang, Emma Topolovec, B. Arana et al.· 0 citations
: Large language models are increasingly being deployed in safety-critical domains, yet remain vulnerable to jailbreak attacks that circumvent safety alignments. This systematic review synthesizes empirical jailbreak research published between 2024 and 2025, using a PRISMA-guided search protocol, followed by BERTopic-based topic modeling. The analysis identifies eight main jailbreak categories: optimization-based, ge-netic/evolutionary, iterative refinement, semantic/persuasion-based, decomposition, context/generation-level, visual/encoding and fuzzing attacks, and characterizes their effectiveness, efficiency, and transferability across open-source and proprietary models, including Llama-2/3, Vicuna, GPT-3.5/4, Claude, Gemini, and DeepSeek-V3. Results show that simple configuration and context-level attacks can match the near-perfect attack success rates of sophisticated white-box optimization methods on models such as Llama-2, while requiring far fewer queries and no parameter access, highlighting a gap between research focus and practical threat severity. The review further identifies five recurring vulnerability mechanisms: representation-level gaps, execution-priority manipulation, semantic fragmentation, gradient-space exploitation and persuasion susceptibility, and documents family-specific vulnerability patterns, with open-source Llama-based models consistently more exposed than safety-enhanced architectures such as Claude. Diverse methods, uneven focus on models and publication bias limit how broadly results apply. Nonetheless, the review reveals that weaknesses in safety alignment persist across successive LLM generations, urging that effective defenses must address all eight attack categories rather than isolated techniques.
Meda Račaitytė, Hélder Bastos, R. Ribeiro et al.· International Conference on...· 0 citations
With the widespread use of open-source components in modern software development, reusing third-party code improves development efficiency while also intensifying security risks in the software supply chain. As the largest open-source package registry in the world, NPM (Node Package Manager) has become a primary target for supply chain attacks. Existing methods for detecting malicious NPM packages face two main challenges. First, traditional program graphs used to represent source code (e.g., Abstract Syntax Tree (AST) and Call Graph (CG)) have limited capability in characterizing malicious behaviors inside code, thereby affecting analysis efficiency and detection accuracy. Second, matching rules for identifying malicious packages mostly rely on manual definition. This process is time-consuming and labor-intensive, and the accuracy of these rules needs improvement. To address these challenges, this paper proposes the PDCG-RuleDetector framework to detect malicious NPM packages. First, this paper uses the proposed Parameterized Data-flow Call Graph (PDCG) to represent script files in NPM packages, and leverages a Large Language Model (LLM) to automatically extract sensitive behavior matching rules from malicious NPM packages, constructing a sensitive behavior matching rule library. Then, this paper marks sensitive nodes in the PDCG according to the rules in the rule library, generates feature vectors from the PDCG, and trains a classifier to detect malicious NPM packages. The effectiveness of the PDCG-RuleDetector framework is validated on widely used datasets. On the MalnpmDB dataset, the proposed model achieves an F1 score of 96.2%, which is better than existing detection methods. On the Robust and Datadog datasets, the F1 scores are 91.2% and 94.9%, respectively. These results show good generalization capability. More importantly, during 10 days of real-world deployment, the framework identified 152 malicious packages among 107,802 newly published NPM packages. All of them were verified and removed by the official NPM security team.
He Bai, Jia-Qi Zhang, Honghui Li et al.· Journal of King Saud Univers...· 0 citations
Findings indicate that ensembling approaches can be statistically significant and effective on larger datasets, where the best-performing ensemble improved performance by 37% over its individual LLMs on the commercial large-scale code.
M. Chochlov, Gul Aftab Ahmed, J. Patten et al.· ACM Transactions on Software...· 1 citation
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
