{"id":"https://openalex.org/W7168907646","doi":"https://doi.org/10.48550/arxiv.2607.13965","title":"ProfMalPlus: Agent-Coordinated Detection of Malicious NPM Packages via Static-Dynamic Analysis Synergy","display_name":"ProfMalPlus: Agent-Coordinated Detection of Malicious NPM Packages via Static-Dynamic Analysis Synergy","publication_year":2026,"publication_date":"2026-07-15","ids":{"openalex":"https://openalex.org/W7168907646","doi":"https://doi.org/10.48550/arxiv.2607.13965"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.13965","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.13965","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.13965","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5073898228","display_name":"Yiheng Huang","orcid":"https://orcid.org/0009-0003-4722-3658"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Huang, Yiheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140966631","display_name":"Zhijia Zhao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhao, Zhijia","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5141000921","display_name":"Bihuan Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Bihuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073610803","display_name":"Susheng Wu","orcid":"https://orcid.org/0009-0005-2169-7032"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Susheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5109404532","display_name":"Zhuotong Zhou","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Zhuotong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5141041326","display_name":"Yiheng Cao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cao, Yiheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140994246","display_name":"Kun Hu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hu, Kun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5141005748","display_name":"Xin Hu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hu, Xin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5141027863","display_name":"Xin Peng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Peng, Xin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.4648999869823456,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.4648999869823456,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.18860000371932983,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.14880000054836273,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.6520000100135803},{"id":"https://openalex.org/keywords/sandbox","display_name":"Sandbox (software development)","score":0.6463000178337097},{"id":"https://openalex.org/keywords/router","display_name":"Router","score":0.6313999891281128},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.4887000024318695},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.4837999939918518},{"id":"https://openalex.org/keywords/transitive-relation","display_name":"Transitive relation","score":0.4787999987602234},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4733000099658966},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.44209998846054077}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8061000108718872},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.6520000100135803},{"id":"https://openalex.org/C167981075","wikidata":"https://www.wikidata.org/wiki/Q2667186","display_name":"Sandbox (software development)","level":2,"score":0.6463000178337097},{"id":"https://openalex.org/C2775896111","wikidata":"https://www.wikidata.org/wiki/Q642560","display_name":"Router","level":2,"score":0.6313999891281128},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.4887000024318695},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.4837999939918518},{"id":"https://openalex.org/C191399111","wikidata":"https://www.wikidata.org/wiki/Q64861","display_name":"Transitive relation","level":2,"score":0.4787999987602234},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4733000099658966},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.4456000030040741},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.44209998846054077},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.40779998898506165},{"id":"https://openalex.org/C96147967","wikidata":"https://www.wikidata.org/wiki/Q190686","display_name":"Subroutine","level":2,"score":0.3912000060081482},{"id":"https://openalex.org/C149810388","wikidata":"https://www.wikidata.org/wiki/Q5374873","display_name":"Emulation","level":2,"score":0.3889999985694885},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.37049999833106995},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.34049999713897705},{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.3019999861717224},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.2930000126361847},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.28940001130104065},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.2851000130176544},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.27970001101493835},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.27570000290870667},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.2702000141143799},{"id":"https://openalex.org/C111498074","wikidata":"https://www.wikidata.org/wiki/Q173326","display_name":"Formal verification","level":2,"score":0.2623000144958496},{"id":"https://openalex.org/C3018397939","wikidata":"https://www.wikidata.org/wiki/Q3644502","display_name":"Open source","level":3,"score":0.2565999925136566},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.2533000111579895}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.13965","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.13965","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.13965","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.13965","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.7036237120628357,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Open":[0],"source":[1],"software":[2],"is":[3,154],"vulnerable":[4],"to":[5,104,146,179],"supply-chain":[6],"attacks":[7],"through":[8],"transitive":[9],"dependencies,":[10],"especially":[11],"malicious":[12,46,164,187],"code":[13,60,165],"injected":[14],"into":[15,115],"NPM":[16,47],"packages.":[17],"Existing":[18],"detectors":[19,176],"often":[20],"inadequately":[21],"model":[22],"obfuscated":[23],"behavior,":[24],"overlook":[25],"JavaScript's":[26],"object-centric":[27],"features,":[28],"poorly":[29],"coordinate":[30],"static":[31,90],"and":[32,35,66,77,87,133,191],"dynamic":[33,137],"analysis,":[34],"lose":[36],"semantic":[37],"information":[38],"during":[39],"behavior":[40,52],"abstraction.":[41],"We":[42],"propose":[43],"ProfMalPlus,":[44],"a":[45,109,122,144,160,171],"package":[48,142],"detector":[49],"combining":[50],"object-sensitive":[51],"graphs":[53,71],"with":[54,167],"coordinated":[55],"LLM":[56,106],"reasoning":[57],"over":[58],"annotated":[59],"slices.":[61],"It":[62,181],"identifies":[63],"installation":[64],"commands":[65],"entry":[67],"files,":[68],"then":[69],"constructs":[70],"capturing":[72],"sensitive":[73],"APIs,":[74],"third-party":[75,126],"calls,":[76],"unresolved":[78],"calls.":[79],"From":[80],"these":[81],"graphs,":[82],"ProfMalPlus":[83,169],"extracts":[84],"security-relevant":[85],"slices":[86],"adds":[88,129],"inline":[89],"analysis":[91],"evidence.":[92],"Local":[93],"judge":[94,111],"agents":[95],"independently":[96],"assess":[97],"each":[98],"slice.":[99],"Self-consistency":[100],"consolidates":[101],"repeated":[102],"judgements":[103],"reduce":[105],"variance,":[107],"while":[108],"global":[110],"synthesizes":[112],"their":[113],"reports":[114,163],"an":[116],"entry-level":[117],"verdict.":[118],"For":[119],"undetermined":[120],"cases,":[121],"router":[123],"selects":[124],"either":[125],"enrichment,":[127],"which":[128,139],"registry":[130],"derived":[131],"module":[132],"method":[134],"semantics,":[135],"or":[136],"augmentation,":[138],"executes":[140],"the":[141],"in":[143],"sandbox":[145],"resolve":[147],"runtime":[148],"dependent":[149],"behavior.":[150],"The":[151],"enriched":[152],"evidence":[153],"fed":[155],"back":[156],"for":[157],"reassessment.":[158],"Finally,":[159],"localization":[161],"agent":[162],"snippets":[166],"explanations.":[168],"achieves":[170],"98.1%":[172],"F1-score,":[173],"outperforming":[174],"state-of-the-art":[175],"by":[177],"3.5%":[178],"52.6%.":[180],"also":[182],"identified":[183],"597":[184],"previously":[185],"unknown":[186],"packages,":[188],"all":[189],"confirmed":[190],"removed":[192],"from":[193],"NPM.":[194]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-17T00:00:00"}