Pack-A-Mal: A Malware Analysis Framework for Open-Source Packages
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866918303409111040 |
|---|---|
| author | Vu, Duc-Ly Nguyen, Thanh-Cong Vu, Minh-Khanh Nguyen, Ngoc-Thanh Thi, Kim-Anh Do |
| author_facet | Vu, Duc-Ly Nguyen, Thanh-Cong Vu, Minh-Khanh Nguyen, Ngoc-Thanh Thi, Kim-Anh Do |
| contents | The increasingly sophisticated environment in which attackers operate makes software security an even greater challenge in open-source projects, where malicious packages are prevalent. Static analysis tools, such as Malcontent, are highly useful but are often incapable of dealing with obfuscated malware. Such situations lead to an unreasonably high rate of false positives. This paper highlights that dynamic analysis, rather than static analysis, provides greater insight but is also more resource-intensive for understanding software behaviour during execution. In this study, we enhance a dynamic analysis tool, package-analysis, to capture key runtime behaviours, including commands executed, files accessed, and network communications. This modification enables the use of container sandboxing technologies, such as gVisor, to analyse potentially malicious packages without significantly compromising the host system. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2511_09957 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Pack-A-Mal: A Malware Analysis Framework for Open-Source Packages Vu, Duc-Ly Nguyen, Thanh-Cong Vu, Minh-Khanh Nguyen, Ngoc-Thanh Thi, Kim-Anh Do Cryptography and Security The increasingly sophisticated environment in which attackers operate makes software security an even greater challenge in open-source projects, where malicious packages are prevalent. Static analysis tools, such as Malcontent, are highly useful but are often incapable of dealing with obfuscated malware. Such situations lead to an unreasonably high rate of false positives. This paper highlights that dynamic analysis, rather than static analysis, provides greater insight but is also more resource-intensive for understanding software behaviour during execution. In this study, we enhance a dynamic analysis tool, package-analysis, to capture key runtime behaviours, including commands executed, files accessed, and network communications. This modification enables the use of container sandboxing technologies, such as gVisor, to analyse potentially malicious packages without significantly compromising the host system. |
| title | Pack-A-Mal: A Malware Analysis Framework for Open-Source Packages |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2511.09957 |