PyPIMalDet: A malicious PyPI package detection method combining code features and metadata features.

Abstract

In recent years, there has been a surge in malicious software packages on the open-source PyPI software package registry. Given the vast number of software packages and frequent updates on PyPI, existing detection methods based on dynamic analysis or large language models are computationally and time-consuming, hindering the feasibility of real-time or large-scale scanning due to efficiency and cost constraints. To address these challenges, we propose a novel malicious package detection method named PyPIMalDet. This method constructs a detector by fusing source code behavior features and metadata features to improve detection performance. To address the feature overlap problem, we introduce a denoising autoencoder module in the code behavior feature extraction process to obtain robust code feature vectors. We design an adaptive fusion stacking ensemble framework for two types of features to achieve efficient and lightweight detection. The experimental results show that PyPIMalDet outperforms six baseline methods in malicious package detection tasks, improving precision and recall by 1.6 %-25.93 % and 1.93 %-14.39 %, respectively. It also demonstrates significant advantages in detection speed. The ablation studies thoroughly validate the effectiveness of multi-dimensional feature fusion, denoising autoencoder module, and the lightweight adaptive fusion stacking ensemble framework.