PaperlayerView exact revision on arXiv

Source-linked AI summary

DistillGuard: Malicious NPM Package Detection and API Attack Chain Analysis via Static Graph and LLM Distillation

Siyuan Pang, Yepeng Yao, Zhengwei Jiang, Zijing Fan, Baoxu Liu

arXiv:2609.28996v1cs.CR

TL;DR

Malicious NPM packages create supply-chain risks, while existing rule-based, machine-learning, and LLM approaches have semantic, generalization, cost, security, or domain-specific limitations. DistillGuard combines static graph features with online LLM knowledge distillation and LoRA fine-tuning; it reports strong detection results and analyzes attack stages and API chains.

  • Problem

    Rule-based methods lack code-semantic understanding, machine-learning methods depend on feature engineering and face concept drift, and existing LLM approaches have cost, data-security, and NPM-domain limitations.

    Source: §I · p. 1

  • Method

    DistillGuard combines multi-granularity static features with online LLM-distilled security knowledge and LoRA fine-tuning of an open-source model.

    Source: §I · pp. 1–2

  • Results

    95.3% accuracy, 99.4% precision, and 93.8% F1 are reported, with DistillGuard outperforming state-of-the-art detection tools.

    Source: §I · p. 2

  • Takeaways & Limitations

    The study characterizes attack stages and malicious behaviors and summarizes eight typical API attack chains for NPM supply-chain defense.

    Source: §I · p. 2

Abstract

from arXiv · show

The Node.js ecosystem heavily relies on NPM packages, and software supply chain attacks targeting malicious NPM packages are rampant. Malicious code primarily triggers during package installation, import, and runtime. Traditional static analysis fails to understand code semantics; machine learning-based methods rely on feature extraction, which suffers from concept drift; existing LLM solutions suffer from high invocation costs, high data security risks, and poor performance. To overcome these limitations, we propose DistillGuard, a lightweight malicious NPM package detection framework that combines static graph semantic analysis and LLM knowledge distillation. DistillGuard first acquires multi-granular features through three static analysis modules. Then, it leverages online LLM to distill high-quality security knowledge and structured labels. Finally, it uses LoRa to efficiently fine-tune the open-source Qwen3-8B model to support offline deployment. Experiments show that DistillGuard achieves an accuracy of 95.3\%, a precision of 99.4\%, and an F1 score of 93.8\%, outperforming state-of-the-art tools, improving the F1-score by 11.1 to 30.0 percentage points over the baselines. Our empirical research further reveals the stages of malicious attacks and the distribution of malicious behaviors. We also summarized eight typical API attack chains for malicious activities, providing practical insights for NPM supply chain security defense.

I. INTRODUCTION

The introduction frames malicious NPM packages as a supply-chain threat and identifies gaps in rule-based, machine-learning, and LLM detection. DistillGuard combines static graph analysis with LLM knowledge distillation, and the paper reports strong detection results alongside an empirical analysis of malicious behavior.

I. INTRODUCTION

  • Rule-based tools lack semantic understanding, machine-learning methods face feature-engineering and concept-drift limits, and existing LLM approaches have cost, security, and domain-performance drawbacks.The paper also notes that current LLM schemes do not mine structured static package features.Source: §I · p. 1
  • DistillGuard combines multi-granularity features from configuration, dependencies, and call graphs with online LLM-distilled security labels and LoRA fine-tuning of Qwen3-8B.The resulting model is intended for fully offline, low-cost deployment.Source: §I · pp. 1–2
  • 95.3% accuracy, 99.4% precision, and 93.8% F1 are reported, with performance described as outperforming state-of-the-art static-analysis, machine-learning, and LLM-based tools.The paper also reports that ablations validate the complementarity and necessity of the static-analysis modules.Source: §I · p. 2
  • The empirical study analyzes attack stages and malicious-behavior distributions, and summarizes eight typical API attack chains to inform NPM supply-chain defense.Behaviors include information leakage, command execution, malicious downloads, and credential theft.Source: §I · p. 2
  • The authors report constructing a large-scale dataset of benign NPM packages.Source: §I · p. 2

II. PRELIMINARY

The preliminary section describes three points at which malicious NPM code may run: installation, module import, and project runtime. It motivates combining static analysis with model distillation and fine-tuning to address limitations of rules and general-purpose LLMs.

A. Background

  • Malicious NPM code can trigger during installation, import, or runtime.Source: A. Background · p. 2
  • Installation hooks in package.json can execute attacker commands automatically, and the text identifies this as a prevalent attack vector.Examples include preinstall and postinstall scripts.Source: A. Background · p. 2
  • Import-phase attacks can run initialization code when a package’s main entry point is loaded through import or require.Source: A. Background · p. 2
  • Runtime attacks may depend on particular inputs, environments, or events, making them harder to trace while their execution probability is relatively lower.Source: A. Background · p. 2
  • The paper motivates combining static analysis, distillation, and fine-tuning because hand-crafted rules generalize poorly to variants and general-purpose LLMs lack NPM-security specialization.Source: A. Background · p. 2

B. Case Study

The case studies illustrate an installation-triggered remote-command attack and an import-triggered reverse shell. Both examples show how package behavior can exploit routine NPM workflows to execute malicious logic.

B. Case Study

  • The nodexda package uses a postinstall hook to run code that retrieves remote data and executes it as a local system command.The described sequence uses HTTPS requests and child-process execution, forming a command-and-control chain.Source: B. Case Study · pp. 2–3
  • The @superbet-group/web.lib.vue-utilities package runs on import and opens a reverse shell by launching /bin/sh and connecting it to a remote socket.Its package configuration omits high-risk lifecycle scripts, while its main field points to the import-time entry point.Source: B. Case Study · p. 3

III. OUR APPROACH

DistillGuard extracts static evidence from NPM packages, distills security knowledge with an online LLM, and fine-tunes a lightweight model for offline detection. Its static analysis examines package configuration, dependencies, and function-call behavior without executing package code.

A. Overview

  • The framework progresses from static graph feature extraction to online LLM knowledge distillation and efficient fine-tuning of a lightweight model.The architecture describes structured soft labels and offline detection as the intended endpoint.Source: A. Overview · pp. 3–4, Figure 3 · p. 4

B. Static Graph Analysis

  • Static analysis examines decompressed packages without executing malicious code, extracting clues from configuration, dependency imports, and function-call logic.Source: B. Static Graph Analysis · p. 4

1) Package.json Configuration Parser:

2) Dependency Import Parser:

  • The dependency parser identifies require() and import behaviors, focusing on sensitive modules for networking, file I/O, system information, and command execution.The extracted imports characterize potential attack capabilities through module dependencies.Source: 2) Dependency Import Parser · p. 4, Figure 5 · p. 4

3) API Call Graph Analyzer:

DistillGuard builds fine-grained function-call graphs, uses an online LLM to turn static features into structured security labels, and fine-tunes Qwen3-8B for local detection.

3) API Call Graph Analyzer:

  • Jelly-derived function-call graphs trace sensitive API execution paths, including multilevel calls and conditionally triggered malicious behavior.The graph is supplied with other parsing results to the online model for knowledge distillation.Source: 3) API Call Graph Analyzer · pp. 4–5

C. Knowledge Distillation

  • GPT-5 analyzes package code, configuration risks, and call logic to produce structured labels covering malicious judgment, confidence, API chains, risky dependencies, and behavior.The input combines source code, package-hook information, sensitive dependencies, and the structured graph.Source: C. Knowledge Distillation · p. 5

D. Fine-Tuning

  • The instruction-tuning dataset maps complete package source code to GPT-5-derived security knowledge, with multidimensional supervision including confidence, API tracking, dependency risk, and behavioral explanations.The paper groups malicious behaviors into eight types.Source: D. Fine-Tuning · p. 5, Table I · p. 5
  • LoRA fine-tuning updates low-rank parameters while freezing Qwen3-8B’s backbone, reducing memory use and avoiding overfitting from full-parameter tuning.The resulting model performs end-to-end risk assessment, confidence evaluation, feature localization, and behavioral analysis for local deployment.Source: D. Fine-Tuning · p. 5

IV. EVALUATION

The evaluation asks about training, detection effectiveness, component contributions, and malicious-package behavior, using constructed malware and benign-package datasets.

IV. EVALUATION

  • The evaluation frames four questions covering training results, detection effectiveness, component contributions, and attack timing, behaviors, and API chains.The dataset section also presents constructed-dataset statistics in Table II.Source: §IV · pp. 5–6, Table II · p. 6

A. Experimental Dataset

  • The malware benchmark combines a manually annotated dataset from prior research with samples supplied by Datadog.The passage identifies the prior work as Duan et al. and Guo et al. [15].Source: A. Experimental Dataset · p. 6
  • The benign set contains 20,306 popular NPM packages, while the fine-tuning subset contains 2,000 benign and 1,000 malicious packages.The benign packages are latest versions cross-checked against major security databases; the fine-tuning subset combines source code with intermediate static-analysis and distillation labels.Source: A. Experimental Dataset · p. 6

B. RQ1: Training Results.

Training diagnostics show declining loss, a linearly decaying learning rate, stable gradient norms, and progress through the preset three epochs.

B. RQ1: Training Results.

C. RQ2: How effective is our tool DistillGuard in detection on the dataset?

DistillGuard outperformed the compared static-analysis, machine-learning, and LLM tools on the reported detection metrics, with an F1 score of 93.81%.

C. RQ2: How effective is our tool DistillGuard in detection on the dataset?

  • OSSGadget achieved 89.05% recall but only 49.72% precision and 63.81% F1, with overall accuracy below 60%.Its rule matching flags sensitive APIs and keywords without checking executable code or malicious execution logic, producing many false positives.Source: C. RQ2: How effective is our tool… · pp. 7–8
  • Cerebro reached 98.00% precision but 58.80% recall and 73.50% F1, missing over 40% of malicious samples.The passage attributes this pattern to a narrow decision boundary and poor generalization to novel or mutated packages.Source: C. RQ2: How effective is our tool… · p. 8
  • Maltracker recorded 86.86% accuracy, 87.00% precision, 78.95% recall, and 82.78% F1, more than 11 percentage points below DistillGuard in F1.The paper identifies manually designed features as a bottleneck for detecting obfuscated or transformed packages.Source: C. RQ2: How effective is our tool… · p. 8
  • SocketAI achieved 77.04% accuracy, 96.10% precision, 44.40% recall, and 60.74% F1, which the authors consider unsuitable for standalone detection.The paper cites conservative scoring, its “critical report” stage, and a 20-file input limit as reasons for missed detections.Source: C. RQ2: How effective is our tool… · p. 8
  • 93.81% F1, 95.31% accuracy, and 99.38% precision put DistillGuard ahead of the compared tools; its F1 exceeds Maltracker by 11 percentage points.The reported recall is 88.82%, more than twice SocketAI’s.Source: Table III · p. 7, C. RQ2: How effective is our tool… · p. 8

D. RQ3: Ablation Study.

Controlled ablations show that all three static-analysis modules contribute complementary features, with the call-graph analyzer especially important for recognizing complex malicious behavior.

D. RQ3: Ablation Study.

  • Without the package.json parser, accuracy is 91.85%, precision is 99.07%, recall is 80.25%, and F1 is 88.86%.The parser captures installation hooks such as preinstall and postinstall; removing it significantly increases false negatives.Source: D. RQ3: Ablation Study · p. 8
  • Without the dependency analyzer, accuracy is 93.97%, precision is 99.02%, recall is 86.25%, and F1 is 92.03%.Without it, the model cannot identify sensitive dependencies such as os, dns, https, and fs in advance; its overall impact is described as moderate.Source: D. RQ3: Ablation Study · p. 8
  • Without the call-graph analyzer, detection of concealed, chained, and conditionally evasive behavior weakens, while false negatives and false positives rise.The call graph organizes code snippets into interpretable attack behaviors and supports model generalization and recall.Source: D. RQ3: Ablation Study · pp. 8–9
  • Removing any one of the three static-analysis modules degrades performance, confirming that their configuration, dependency, and behavioral features are complementary.The ablations remove one branch at a time under identical testing conditions.Source: D. RQ3: Ablation Study · pp. 8–9

E. RQ4: Empirical Study of Malicious Behaviors in NPM Packages.

The empirical study finds that malicious NPM packages most often trigger during installation and predominantly exfiltrate information. It also characterizes API chains across several attack behaviors.

E. RQ4: Empirical Study of Malicious Behaviors in NPM Packages.

  • Nearly 88% of malicious cases are install-time attacks, compared with approximately 7% import-time and 5% run-time attacks.The study attributes the install-time pattern to lifecycle hooks such as preinstall and postinstall.Source: E. RQ4: Empirical Study of Malicious… · p. 9, Table V · p. 9
  • Info-Exfiltration accounts for 81.51% of malicious packages, Command-Execution for 8.41%, and Malicious-Download for 5.52%.Credential-Theft, Code-Obfuscation, DNS-Tunneling, Resource-Abuse, and Persistence are less common but still pose security risks.Source: E. RQ4: Empirical Study of Malicious… · p. 9, Table VI · p. 9
  • Info-Exfiltration chains often collect host and environment details, encode them, and transmit them to attacker-controlled servers over HTTPS.Many are launched at install time through preinstall or postinstall hooks; Table VII presents typical chains and required dependencies.Source: E. RQ4: Empirical Study of Malicious… · p. 9, Table VII · p. 10
  • Command-Execution attacks occur during installation and runtime, often using child_process to invoke shells or OS commands.Some establish reverse shells through network sockets, forwarding local input and output to remote attackers.Source: E. RQ4: Empirical Study of Malicious… · p. 9
  • Malicious-Download attacks predominantly occur at install time, fetching remote payloads, writing them to the filesystem, and executing them.The described chain uses HTTP or HTTPS requests, filesystem APIs, and child-process mechanisms.Source: E. RQ4: Empirical Study of Malicious… · p. 9
  • Credential-theft chains use the filesystem to read local application storage and may verify extracted tokens through the Discord API.The passage names node-fetch and axios as network libraries used to steal data.Source: E. RQ4: Empirical Study of Malicious… · p. 9
  • The study also supplies typical API chains and commonly used dependencies for less common Code-Obfuscation, DNS-Tunneling, Resource-Abuse, and Persistence attacks.These behaviors are described as less common but still warrant attention and defense.Source: E. RQ4: Empirical Study of Malicious… · p. 10

V. RELATED WORK

Prior NPM package-detection work spans rule-based, machine-learning, LLM, and hybrid approaches, while related registry-security research covers threats beyond NPM. The conclusion presents DistillGuard as an offline detection framework and reports its comparative results and empirical analysis.

V. RELATED WORK

  • Rule-based methods use static rules for suspicious APIs and metadata, while machine-learning methods use handcrafted features; both face limitations in adapting to evolving or obfuscated attacks.The passage cites GUARDDOG and OSSGadget as rule-based examples, and lightgbm, XGBoost, AMALFI, and CEREBRO among machine-learning approaches.Source: §V · p. 10
  • LLM approaches such as SocketAI and SPIDERSCAN support semantic analysis but face hallucinations and computational costs; hybrid tools include DONAPI and MALGUARD.The passage notes that dynamic analysis in MALGUARD introduces performance overhead.Source: §V · p. 10
  • Related registry-security studies address threats across NPM, PyPI, and Docker Hub, but most detection tools remain platform-specific and lack cross-registry generalization.The cited threats include typosquatting, dependency obfuscation, account hijacking, outdated components, secret leakage, and implanted malicious programs.Source: §V · p. 10

VI. CONCLUSION

  • DistillGuard combines static graph analysis, distilled security knowledge, and LoRA fine-tuning; the conclusion reports 99.4% precision, 88.9% recall, and 93.8% F1.The paper also reports a comprehensive empirical study characterizing NPM attack patterns and typical malicious API chains.Source: §VI · p. 10
  • The paper frames DistillGuard’s contribution as actionable insights for securing the JavaScript open-source supply chain.The conclusion describes the framework as lightweight and data secure.Source: §VI · pp. 10–11
Loading 2609.28996v1…