LATIDIA · Ciberseguridad

DistillGuard: Detección de paquetes NPM maliciosos y análisis de la cadena de ataque API a través de gráficos estáticos y destilación LLM

arXiv: 2609.28996v1Tipo de anuncio: nuevo Resumen: El ecosistema Node.js depende en gran medida de los paquetes NPM, y los ataques a la cadena de suministro de software dirigidos a paquetes NPM maliciosos son desenfrenados. El código malicioso desencadena principalmente duri

La noticia

arXiv:2609.28996v1 Announce Type: new Abstract: The Node.js ecosystem heavily relies on NPM packages, and software supply chain attacks targeting malicious NPM packages are rampant. Malicious code primarily triggers during package installation, import, and runtime. Traditional static analysis fails to understand code semantics; machine learning-based methods rely on feature extraction, which suffers from concept drift; existing LLM solutions suffer from high invocation costs, high data security risks, and poor performance. To overcome these limitations, we propose DistillGuard, a lightweight malicious NPM package detection framework that combines static graph semantic analysis and LLM knowledge distillation. DistillGuard first acquires multi-granular features through three static analysis modules. Then, it leverages online LLM to distill