Search papers, labs, and topics across Lattice.
This paper evaluates 13 LLMs on their ability to detect malicious packages and identify specific malicious indicators within those packages using a dataset of 4,070 packages. The study reveals a "granularity gap," where LLMs, particularly GPT-4.1, achieve high accuracy in binary classification of malicious packages but significantly lower performance in identifying specific malicious indicators. The analysis also finds that parameter size and context window have little impact on detection accuracy, suggesting limitations in semantic understanding at a granular level.
LLMs can almost perfectly detect malicious software packages, but their accuracy plummets when asked to pinpoint *why* a package is malicious.
The prevalence of malicious packages in open-source repositories, such as PyPI, poses a critical threat to the software supply chain. While Large Language Models (LLMs) have emerged as a promising tool for automated security tasks, their effectiveness in detecting malicious packages and indicators remains underexplored. This paper presents a systematic evaluation of 13 LLMs for detecting malicious software packages. Using a curated dataset of 4,070 packages (3,700 benign and 370 malicious), we evaluate model performance across two tasks: binary classification (package detection) and multi-label classification (identification of specific malicious indicators). We further investigate the impact of prompting strategies, temperature settings, and model specifications on detection accuracy. We find a significant "granularity gap" in LLMs' capabilities. While GPT-4.1 achieves near-perfect performance in binary detection (F1 $\approx$ 0.99), performance degrades by approximately 41\% when the task shifts to identifying specific malicious indicators. We observe that general models are best for filtering out the majority of threats, while specialized coder models are better at detecting attacks that follow a strict, predictable code structure. Our correlation analysis indicates that parameter size and context width have negligible explanatory power regarding detection accuracy. We conclude that while LLMs are powerful detectors at the package level, they lack the semantic depth required for precise identification at the granular indicator level.
