Search papers, labs, and topics across Lattice.
This paper introduces MalTotal, a novel framework for detecting malicious code poisoning in open-source software that operates in a language-agnostic manner. By employing LLM-assisted semantic reasoning and hybrid semantic slicing, MalTotal significantly reduces analysis costs while maintaining high detection accuracy, achieving an average F1-score of 93.1% across five programming languages. In a comprehensive evaluation of 120,000 GitHub repositories, MalTotal identified 564 previously unknown malicious repositories at a dramatically reduced cost, showcasing its effectiveness and scalability in addressing security risks in OSS.
MalTotal uncovers 564 previously unknown malicious repositories while slashing analysis costs from $86.25 to just $5.19.
The widespread adoption of open source software (OSS) has introduced significant security risks, with malicious code poisoning attacks increasingly targeting public package registries and open-source platforms. Existing detection approaches, including heuristic-, learning-, and LLM-based methods, suffer from language-specific designs, limited generalization, and high analysis costs, making them unsuitable for large-scale multi-language analysis. To address these challenges, we propose MalTotal, a scalable and cost-effective framework for language-agnostic malicious code detection. MalTotal leverages LLM-assisted semantic reasoning to identify sensitive APIs, perform hybrid semantic slicing, and reconstruct malicious behavior contexts while reducing analysis overhead. Our evaluations show that MalTotal outperforms 8 state-of-the-art baselines, achieving an average F1-score of 93.1% across 5 mainstream languages. Its hybrid slicing reduces LLM token consumption by 94.0%, lowering the analysis cost from \$86.25 to \$5.19 on 2,168 repositories. In a large-scale study of 120K GitHub repositories containing over 7.3 million files, MalTotal discovered 564 previously unknown malicious repositories across multiple languages at a total cost of \$338. These results demonstrate the effectiveness, scalability, and cost-efficiency of MalTotal in mitigating large-scale code poisoning attacks.
