Install. Execute. Persist. Repeat : LLM-Assisted Reverse Engineering of Execution Paths in Malicious Packages
Since early 2025, open-source ecosystems have emerged as the software supply chain’s most strategically exploited trust boundary, with adversaries shifting from isolated compromises to scalable infiltration through malicious package publication, upstream maintainer compromise, and CI/CD abuse. By leveraging typosquatting, dependency confusion, update injection, adversary-in-the-middle phishing, credential theft, and social engineering, attackers transform trusted repositories into stealth delivery channels for malicious code. Incidents involving Shai-Hulud, TeamPCP’s compromises of Trivy and LiteLLM, and North Korea’s takeover of Axios underscore a growing reality while routine developer actions such as installs, imports, and automated builds now serve as high-impact intrusion vectors across thousands of environments.
Hybrid Detection Framework for Early Identification of Malicious Packages
Stage 1: Large-Scale Static Package Scanning
- As part of this research, we developed a hybrid detection framework designed to identify malicious or compromised packages at an early stage with high accuracy, combining large-scale static package scanning with LLM-driven semantic analysis.
- The static analysis engine quickly filters large numbers of package releases by flagging suspicious signals, including:
- Obfuscated or minified code: hides true intent and complicates manual review
- Encrypted content: conceals payloads from straightforward inspection
- Unusual post-install scripts: common vector for executing code right after installation
- Unexpected network activity: may indicate data exfiltration or C2 communication
- Access to environment variables: often used to steal tokens, keys, or credentials
- Risky execution methods such as eval, exec, and child or subprocess calls: enable dynamic or arbitrary command execution
- This stage provides broad coverage across the ecosystem while enabling efficient triagefor deeper analysis.
Stage 2: LLM-Driven Triage and Contextual Reasoning
- The second phase adds an LLM-based triage and reasoning layer that allows us to look beyond obvious warning signs and evaluate package behavior in context.
- Each new release is first reviewed by a lightweight, low-cost model that quickly identifies which packages deserve closer inspection.
- To keep the system scalable and cost-effective, we apply the following optimizations:
- Caching: avoid rescanning the same content across releases
- Targeted extraction: pull out only the most relevant files and functions
- Focused chunking: break security-sensitive code and metadata into smaller, focused chunks for analysis
Packages flagged in the first triage stage are passed to an AI agent that uses specialized tools for metadata review, code similarity checks, function and IOC extraction, and deeper static analysis of suspicious files and execution paths. Instead of treating packages as raw text, the agent pulls only the most relevant code, dependencies, and artifacts on demand, enabling focused, iterative investigation. This allows the investigation to stay targeted and iterative rather
than treating the package as raw text alone. In practice, the framework helps trace likely malicious logic, infer runtime behavior from static patterns, and distinguish intentionally malicious packages from legitimate packages that may have been compromised. We ground this approach in real-world case studies that reconstruct recent supply-chain kill chains, attacker objectives, and recurring tradecraft aimed at CI/CD environments and maintainer ecosystems.
Satyam Singh – Zscaler Inc.
I am a Senior Security Researcher with ThreatLabz at Zscaler, Inc., with over 4.5 years of experience in cybersecurity. My work focuses on threat analysis, vulnerability research, malware investigation, and analyzing malicious packages across modern software ecosystems.
I have authored multiple technical research blogs covering real-world threats, attacker techniques, vulnerabilities, and emerging risks. Through my research, I aim to make complex security topics easier to understand and help the cybersecurity community strengthen detection, response, and defense strategies.
I am passionate about both offensive and defensive security, with a strong interest in uncovering malicious behavior, analyzing attack patterns, and identifying security weaknesses before threat actors can abuse them. Outside of work, I enjoy playing video games, participating in Capture The Flag competitions, and continuously exploring new areas of security research to sharpen my skills.
Avinash Kumar – Zscaler Inc.
Avinash Kumar works at Zscaler ThreatLabZ as a senior manager – MalwareLabz – security researcher. He has worked in the threat research field for more than 15 years. He previously worked at Norman and Genpact as a senior malware analyst. His research areas include different malware categories with advance malware botnet and analysing the various campaigns on daily basis. Avinash holds a Master’s degree in computer application from Punjab Technical University. Apart from malware research, he loves to play cricket and table tennis.
Nirmal Singh – Zscaler Inc.
Nirmal Singh is Senior Director for the security research team at Zscaler ThreatLabZ located at Chandigarh, India. Nirmal has a Ph.D. in computer science and has been working in the threat research and analysis field for the past 17 years. He oversees malware research, detection and innovation at Zscaler. Prior to Zscaler, he worked with Norman as a manager for the threat response team.