Leveraging Large Language Models to Detect npm Malicious Packages — mentioned by 33a

Mon, 08 Sep 2025 23:54:51 GMT

We use a mix of static analysis and AI. Flagged packages are escalated to a human review team. If we catch a malicious package, we notify our users, block installation and report them to the upstream package registries. Suspected malicious packages that have not yet been reviewed by a human are blocked for our users, but we don't try to get them removed until after they have been triaged by a human. In this incident, we detected the packages quickly, reported them, and they were taken down shortly after. Given how high profile the attack was we also published an analysis soon after, as did…

Paper and discussion history. A mention is not an endorsement.

Leveraging Large Language Models to Detect npm Malicious Packages · HackerPapers discussions

Leveraging Large Language Models to Detect npm Malicious Packages — mentioned by 33a