DONAPI: Malicious NPM Packages Detector using Behavior Sequence Knowledge Mapping

arXiv:2403.08334v1 Announce Type: new
Abstract: With the growing popularity of modularity in software development comes the rise of package managers and language ecosystems. Among them, npm stands out as the most extensive package manager, hosting more than 2 million third-party open-source packages that greatly simplify the process of building code. However, this openness also brings security risks, as evidenced by numerous package poisoning incidents.
In this paper, we synchronize a local package cache containing more than 3.4 million packages in …

arxiv building code cs.cr detector development ecosystems hosting knowledge language malicious malicious npm manager managers mapping npm package package manager package managers packages party process simplify software software development third third-party