ProfMalPlus: Agent-Coordinated Detection of Malicious NPM Packages via Static-Dynamic Analysis Synergy

2026-07-16 · Source: cs.SE updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Expert, extended

Summary

ProfMalPlus is a malicious NPM package detector designed to counter supply chain attacks by addressing limitations in existing detection methods. It achieves a 98.1% F1-score, outperforming state-of-the-art detectors by 3.5% to 52.6%. The system combines object-sensitive behavior graph analysis with a coordinated multi-agent LLM-based reasoning framework. This framework processes security-relevant code slices, enriching them with inline evidence from static analysis, registry-derived third-party semantics, and dynamic augmentation via sandbox execution for runtime-dependent behaviors. ProfMalPlus employs local and global judge agents, a router agent for adaptive evidence gathering, and a localization agent to pinpoint malicious code snippets with explanations. In real-world monitoring, it detected 597 previously unknown malicious NPM packages, all confirmed and removed, at a monetary cost of \$67.45, significantly cheaper than other LLM-based solutions.

Key takeaway

For AI Security Engineers managing NPM dependencies, traditional static or dynamic analysis tools may miss sophisticated, obfuscated threats. You should consider integrating advanced hybrid detection systems like ProfMalPlus, which combine behavior graph analysis with multi-agent LLM reasoning. This approach provides superior accuracy and interpretability, pinpointing malicious code and explaining its intent, as demonstrated by detecting 597 unknown malicious packages. While incurring higher runtime, its cost-effective evidence acquisition strategy makes it a valuable addition to your supply chain security toolkit.

Key insights

ProfMalPlus synergizes behavior graphs with LLM-based multi-agent reasoning for robust, interpretable NPM malware detection.

Principles

• Static and dynamic analysis synergy improves detection.
• Multi-agent LLM reasoning enhances interpretability.
• Code slicing preserves source-level semantics.

Method

ProfMalPlus constructs object-sensitive behavior graphs, extracts annotated code slices, then uses coordinated LLM agents (local, global, router) in a closed loop for iterative evidence gathering and verdict generation, including third-party enrichment and dynamic augmentation.

In practice

• Apply object-sensitive analysis for obfuscated JavaScript.
• Integrate static and dynamic analysis evidence.
• Prioritize cheaper evidence before sandbox execution.

Topics

• Malicious Package Detection
• NPM Supply Chain Security
• Static-Dynamic Analysis
• Large Language Models
• Multi-Agent Systems
• Behavior Graphs

Code references

• yiheng98/ProfMalPlus
• DataDog/guarddog
• microsoft/OSSGadget
• cs-au-dk/jelly
• Haiyang-Sun/nodeprof.js

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, AI Security Engineer, Machine Learning Engineer

Related on AIssential

• Detecting Vulnerability-Inducing Commits via Multi-Stage Reasoning with LLM-Based Agents — A multi-agent, multi-stage LLM framework significantly improves vulnerability-inducing commit detection and explainability.
• Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models — CAPTAIN employs context-augmented perplexity from pre-trained language models for APT detection, significantly reducing data curation needs.
• Google Cloud launches AI cybersecurity agent CodeMender — CodeMender is a multi-model AI agent automating vulnerability discovery, verification, and patching to accelerate cybersecurity remediation.
• Empirical Software Engineering TerraProbe: A Layered-Oracle Framework for Detecting Deceptive Fixes in LLM-Assisted Terraform — LLM-assisted Terraform security repairs frequently produce deceptive fixes that bypass automated checks, leaving vulnerabilities active.
• Code-Augur: Agentic Vulnerability Detection via Specification Inference — Agentic vulnerability detection improves by making LLM assumptions explicit and continuously validating them with fuzzing.
• Multi-Agent Firewall Architecture for Privacy Protection of Sensitive Data in Interactions with Language Models — A multi-agent firewall architecture secures LLM interactions by intercepting traffic and preventing data leakage through hybrid detection.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.SE updates on arXiv.org.