Detecting Malicious NPM Packages Using Agents

Summary & Methodology Analysis

ProfMalPlus identifies threats by first parsing scripts for harmful shell commands and constructing object-sensitive behavior graphs (BG) to map control flows and data dependencies. It then extracts suspicious code slices from these graphs. To handle uncertainty, a router agent decides whether to supplement these slices with external evidence, such as dynamic analysis in a sandbox or registry metadata. This process creates a richer dataset for the reasoning agents to evaluate the threat level of specific code segments.

The core of the detection logic is a multi-agent reasoning framework. Local judge agents perform independent assessments of code slices, utilizing self-consistency verification to ensure reliability. A global judge agent then synthesizes these individual inputs into a final verdict for the entry file. If a threat is confirmed, a dedicated localization agent identifies the exact malicious code snippets within the original source files. This approach allows the system to remain modular while processing complex dependency trees.

Despite its strong performance, the architecture has notable constraints. It cannot detect malicious behaviors that only trigger during runtime, as opposed to installation or import time. Furthermore, the tool does not address prototype pollution vulnerabilities. Operational efficiency is also constrained by the input size, as large files can lead to slices that exceed the context window of the LLM, a component that processes sequential data by predicting tokens based on surrounding text, which results in truncated evidence.