How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study
Published in ASE, 2026
The first large-scale empirical study of NPM malicious package detection, evaluating 11 tools with 16 variants on a unified benchmark of 6,420 malicious and 7,288 benign packages annotated with 11 behavior categories and 8 evasion techniques, and inspecting each tool’s source code to explain why tools succeed or fail.
Recommended citation: W. Guo, Z. Chen, Z. Xu, C. Liu, M. Kang, S. Song, Chengyue Liu, et al. (2026). "How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study." IEEE/ACM International Conference on Automated Software Engineering (ASE 2026).
Download Paper