PDCG-RuleDetector: parameterized data-flow call graphs meet large language models for malicious NPM package detection

Abstract

With the widespread use of open-source components in modern software development, reusing third-party code improves development efficiency while also intensifying security risks in the software supply chain. As the largest open-source package registry in the world, NPM (Node Package Manager) has become a primary target for supply chain attacks. Existing methods for detecting malicious NPM packages face two main challenges. First, traditional program graphs used to represent source code (e.g., Abstract Syntax Tree (AST) and Call Graph (CG)) have limited capability in characterizing malicious behaviors inside code, thereby affecting analysis efficiency and detection accuracy. Second, matching rules for identifying malicious packages mostly rely on manual definition. This process is time-consuming and labor-intensive, and the accuracy of these rules needs improvement. To address these challenges, this paper proposes the PDCG-RuleDetector framework to detect malicious NPM packages. First, this paper uses the proposed Parameterized Data-flow Call Graph (PDCG) to represent script files in NPM packages, and leverages a Large Language Model (LLM) to automatically extract sensitive behavior matching rules from malicious NPM packages, constructing a sensitive behavior matching rule library. Then, this paper marks sensitive nodes in the PDCG according to the rules in the rule library, generates feature vectors from the PDCG, and trains a classifier to detect malicious NPM packages. The effectiveness of the PDCG-RuleDetector framework is validated on widely used datasets. On the MalnpmDB dataset, the proposed model achieves an F1 score of 96.2%, which is better than existing detection methods. On the Robust and Datadog datasets, the F1 scores are 91.2% and 94.9%, respectively. These results show good generalization capability. More importantly, during 10 days of real-world deployment, the framework identified 152 malicious packages among 107,802 newly published NPM packages. All of them were verified and removed by the official NPM security team.