{"id":"https://openalex.org/W7125399035","doi":"https://doi.org/10.1016/j.jss.2026.112792","title":"Many hands make light work: An LLM-based multi-agent system for detecting malicious PyPI packages","display_name":"Many hands make light work: An LLM-based multi-agent system for detecting malicious PyPI packages","publication_year":2026,"publication_date":"2026-01-22","ids":{"openalex":"https://openalex.org/W7125399035","doi":"https://doi.org/10.1016/j.jss.2026.112792"},"language":"en","primary_location":{"id":"doi:10.1016/j.jss.2026.112792","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.jss.2026.112792","pdf_url":null,"source":{"id":"https://openalex.org/S37879656","display_name":"Journal of Systems and Software","issn_l":"0164-1212","issn":["0164-1212","1873-1228"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Systems and Software","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.jss.2026.112792","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5123611477","display_name":"Muhammad Umar Zeshan","orcid":null},"institutions":[{"id":"https://openalex.org/I26415053","display_name":"University of L'Aquila","ror":"https://ror.org/01j9p1r26","country_code":"IT","type":"education","lineage":["https://openalex.org/I26415053"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Muhammad Umar Zeshan","raw_affiliation_strings":["Universit\u2018a degli studi dell\u2019Aquila, L\u2019Aquila, 67100, Italy"],"raw_orcid":"https://orcid.org/0009-0002-5738-8969","affiliations":[{"raw_affiliation_string":"Universit\u2018a degli studi dell\u2019Aquila, L\u2019Aquila, 67100, Italy","institution_ids":["https://openalex.org/I26415053"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120083968","display_name":"Motunrayo Osatohanmen Ibiyo","orcid":null},"institutions":[{"id":"https://openalex.org/I26415053","display_name":"University of L'Aquila","ror":"https://ror.org/01j9p1r26","country_code":"IT","type":"education","lineage":["https://openalex.org/I26415053"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Motunrayo Ibiyo","raw_affiliation_strings":["Universit\u2018a degli studi dell\u2019Aquila, L\u2019Aquila, 67100, Italy"],"raw_orcid":"https://orcid.org/0009-0005-0308-8997","affiliations":[{"raw_affiliation_string":"Universit\u2018a degli studi dell\u2019Aquila, L\u2019Aquila, 67100, Italy","institution_ids":["https://openalex.org/I26415053"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047553297","display_name":"Claudio Di Sipio","orcid":"https://orcid.org/0000-0001-9872-9542"},"institutions":[{"id":"https://openalex.org/I26415053","display_name":"University of L'Aquila","ror":"https://ror.org/01j9p1r26","country_code":"IT","type":"education","lineage":["https://openalex.org/I26415053"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Claudio Di Sipio","raw_affiliation_strings":["Universit\u2018a degli studi dell\u2019Aquila, L\u2019Aquila, 67100, Italy"],"raw_orcid":"https://orcid.org/0000-0001-9872-9542","affiliations":[{"raw_affiliation_string":"Universit\u2018a degli studi dell\u2019Aquila, L\u2019Aquila, 67100, Italy","institution_ids":["https://openalex.org/I26415053"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111191577","display_name":"Phuong Thi Lan Nguyen","orcid":null},"institutions":[{"id":"https://openalex.org/I26415053","display_name":"University of L'Aquila","ror":"https://ror.org/01j9p1r26","country_code":"IT","type":"education","lineage":["https://openalex.org/I26415053"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Phuong T. Nguyen","raw_affiliation_strings":["Universit\u2018a degli studi dell\u2019Aquila, L\u2019Aquila, 67100, Italy"],"raw_orcid":"https://orcid.org/0000-0002-3666-4162","affiliations":[{"raw_affiliation_string":"Universit\u2018a degli studi dell\u2019Aquila, L\u2019Aquila, 67100, Italy","institution_ids":["https://openalex.org/I26415053"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5002764716","display_name":"Davide Di Ruscio","orcid":"https://orcid.org/0000-0002-5077-6793"},"institutions":[{"id":"https://openalex.org/I26415053","display_name":"University of L'Aquila","ror":"https://ror.org/01j9p1r26","country_code":"IT","type":"education","lineage":["https://openalex.org/I26415053"]}],"countries":["IT"],"is_corresponding":true,"raw_author_name":"Davide Di Ruscio","raw_affiliation_strings":["Universit\u2018a degli studi dell\u2019Aquila, L\u2019Aquila, 67100, Italy"],"raw_orcid":"https://orcid.org/0000-0002-5077-6793","affiliations":[{"raw_affiliation_string":"Universit\u2018a degli studi dell\u2019Aquila, L\u2019Aquila, 67100, Italy","institution_ids":["https://openalex.org/I26415053"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5002764716"],"corresponding_institution_ids":["https://openalex.org/I26415053"],"apc_list":{"value":3820,"currency":"USD","value_usd":3820},"apc_paid":{"value":3820,"currency":"USD","value_usd":3820},"fwci":12.9635,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.97928408,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":98},"biblio":{"volume":"236","issue":null,"first_page":"112792","last_page":"112792"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.6513000130653381,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.6513000130653381,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.22470000386238098,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.04659999907016754,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/modular-design","display_name":"Modular design","score":0.7197999954223633},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.5185999870300293},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5152000188827515},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.43950000405311584},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.40560001134872437},{"id":"https://openalex.org/keywords/abstraction","display_name":"Abstraction","score":0.3571000099182129},{"id":"https://openalex.org/keywords/false-alarm","display_name":"False alarm","score":0.326200008392334}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8080000281333923},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.7197999954223633},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5185999870300293},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5152000188827515},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.43950000405311584},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.40560001134872437},{"id":"https://openalex.org/C124304363","wikidata":"https://www.wikidata.org/wiki/Q673661","display_name":"Abstraction","level":2,"score":0.3571000099182129},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.326200008392334},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3147999942302704},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.31279999017715454},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.2930000126361847},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.2847999930381775},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.2797999978065491},{"id":"https://openalex.org/C2776937656","wikidata":"https://www.wikidata.org/wiki/Q2229669","display_name":"Nesting (process)","level":2,"score":0.27379998564720154},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.27149999141693115},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2655999958515167},{"id":"https://openalex.org/C145428669","wikidata":"https://www.wikidata.org/wiki/Q471748","display_name":"Exception handling","level":2,"score":0.258899986743927},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.25839999318122864},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.2549999952316284},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.25119999051094055}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.jss.2026.112792","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.jss.2026.112792","pdf_url":null,"source":{"id":"https://openalex.org/S37879656","display_name":"Journal of Systems and Software","issn_l":"0164-1212","issn":["0164-1212","1873-1228"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Systems and Software","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.jss.2026.112792","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.jss.2026.112792","pdf_url":null,"source":{"id":"https://openalex.org/S37879656","display_name":"Journal of Systems and Software","issn_l":"0164-1212","issn":["0164-1212","1873-1228"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Systems and Software","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.4110410809516907}],"awards":[{"id":"https://openalex.org/G3859019141","display_name":null,"funder_award_id":"2022LKJWHC","funder_id":"https://openalex.org/F5497039910","funder_display_name":"Ministero dell'Istruzione e del Merito"},{"id":"https://openalex.org/G7274648008","display_name":null,"funder_award_id":"P2022553SL","funder_id":"https://openalex.org/F4320321873","funder_display_name":"Ministero dell\u2019Istruzione, dell\u2019Universit\u00e0 e della Ricerca"},{"id":"https://openalex.org/G736152995","display_name":null,"funder_award_id":"2020W3A5FY","funder_id":"https://openalex.org/F5497039910","funder_display_name":"Ministero dell'Istruzione e del Merito"}],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320321873","display_name":"Ministero dell\u2019Istruzione, dell\u2019Universit\u00e0 e della Ricerca","ror":"https://ror.org/0166hxq48"},{"id":"https://openalex.org/F4320331528","display_name":"Ministero dell'Universit\u00e0 e della Ricerca","ror":"https://ror.org/0341vw408"},{"id":"https://openalex.org/F4320334322","display_name":"HORIZON EUROPE Framework Programme","ror":null},{"id":"https://openalex.org/F5497039910","display_name":"Ministero dell'Istruzione e del Merito","ror":"https://ror.org/01ehyh486"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":4,"referenced_works":["https://openalex.org/W2749928722","https://openalex.org/W2963935794","https://openalex.org/W4360948905","https://openalex.org/W4404711543"],"related_works":[],"abstract_inverted_index":{"Malicious":[0],"code":[1,26,197],"in":[2,24,46,207],"open-source":[3],"repositories":[4],"such":[5],"as":[6,183],"PyPI":[7,69],"poses":[8],"a":[9,59,97,121,132],"growing":[10],"threat":[11],"to":[12,66],"software":[13,41,208],"supply":[14,209],"chains.":[15],"Traditional":[16],"rule-based":[17],"tools":[18],"often":[19],"overlook":[20],"the":[21,91,189,201],"semantic":[22],"patterns":[23],"source":[25],"that":[27,62],"are":[28],"crucial":[29],"for":[30,40,78,101,107,195],"identifying":[31],"adversarial":[32],"components.":[33],"Large":[34],"language":[35],"models":[36],"(LLMs)":[37],"show":[38],"promise":[39],"analysis,":[42],"yet":[43],"their":[44],"use":[45],"interpretable":[47],"and":[48,85,128,139,153,167,174,199],"modular":[49,204],"security":[50],"pipelines":[51],"remains":[52],"limited.":[53],"This":[54],"paper":[55],"presents":[56],"LAMPS":[57,110,147],",":[58,84,88,120,131,146,162],"multi-agent":[60,205],"system":[61,72],"employs":[63],"collaborative":[64],"LLMs":[65],"detect":[67],"malicious":[68,196],"packages.":[70],"The":[71,186],"consists":[73],"of":[74,124,191,203],"four":[75],"role-specific":[76],"agents":[77,106],"package":[79],"retrieval,":[80],"file":[81],"extraction,":[82],"classification":[83,102],"verdict":[86],"aggregation":[87],"coordinated":[89],"through":[90],"CrewAI":[92],"framework.":[93],"A":[94],"prototype":[95],"combines":[96],"fine-tuned":[98,175],"CodeBERT":[99],"model":[100],"with":[103,136],"LLaMA":[104],"3":[105],"contextual":[108],"reasoning.":[109],"has":[111],"been":[112],"evaluated":[113],"on":[114],"two":[115],"complementary":[116],"datasets:":[117],"D":[118,129,144,160],"1":[119,145],"balanced":[122,169],"collection":[123],"6,000":[125],"setup.py":[126],"files,":[127],"2":[130,161],"realistic":[133],"multi-file":[134],"dataset":[135],"1,296":[137],"files":[138],"natural":[140],"class":[141],"imbalance.":[142],"On":[143,159],"achieves":[148],"97.7%":[149],"accuracy,":[150,170],"surpassing":[151],"MPHunter":[152],"TD-IDF":[154],"stacking":[155],"models\u2013two":[156],"state-of-the-art":[157],"approaches.":[158],"it":[163],"reaches":[164],"99.5%":[165,168],"accuracy":[166],"outperforming":[171],"RAG-based":[172],"approaches":[173],"single-agent":[176],"baselines.":[177],"McNemar\u2019s":[178],"test":[179],"confirmed":[180],"these":[181],"improvements":[182],"highly":[184],"significant.":[185],"results":[187],"demonstrate":[188],"feasibility":[190],"distributed":[192],"LLM":[193],"reasoning":[194],"detection":[198],"highlight":[200],"benefits":[202],"designs":[206],"chain":[210],"security.":[211]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-08-29T07:29:34.045763","created_date":"2026-01-23T00:00:00"}