PyPIMalDet: A malicious PyPI package detection method combining code features and metadata features.

Area of Science:

• Software Engineering
• Cybersecurity
• Machine Learning

Background:

• The open-source PyPI registry faces increasing malicious package threats.
• Current detection methods are slow and costly, limiting real-time scanning.

Purpose of the Study:

• To develop an efficient and accurate malicious package detection method for PyPI.
• To overcome the limitations of existing computationally intensive detection techniques.

Main Methods:

• PyPIMalDet fuses source code behavior and metadata features.
• A denoising autoencoder module enhances code feature robustness.
• An adaptive fusion stacking ensemble framework enables lightweight detection.

Main Results:

• PyPIMalDet significantly outperforms six baseline methods in precision and recall.
• Detection speed is substantially improved compared to existing approaches.
• Ablation studies confirm the effectiveness of feature fusion and the ensemble framework.

Conclusions:

• PyPIMalDet offers a computationally efficient and highly effective solution for detecting malicious PyPI packages.
• The novel approach enhances the security of the open-source software ecosystem.
• This method supports scalable and real-time security monitoring of software registries.