# A Large-scale Fine-grained Analysis of Packages in Open-Source Software Ecosystems

arXiv: https://arxiv.org/abs/2404.11467 · HTML: https://mlsanity.com/paper/2404.11467/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Apr 2024.

## Built on by (most cited first, 2 of 2)

- [CHASE: LLM Agents for Dissecting Malicious PyPI Packages](https://mlsanity.com/paper/2601.06838/) (2026)
- [ToolSearcher: Optimizing Tool Selection at Scale via Reinforcement Learning](https://mlsanity.com/paper/2609.30906/) (2026)

## Abstract (arXiv)

Package managers such as NPM, Maven, and PyPI play a pivotal role in open-source software (OSS) ecosystems, streamlining the distribution and management of various freely available packages. The fine-grained details within software packages can unveil potential risks within existing OSS ecosystems, offering valuable insights for detecting malicious packages. In this study, we undertake a large-scale empirical analysis focusing on fine-grained information (FGI): the metadata, static, and dynamic functions. Specifically, we investigate the FGI usage across a diverse set of 50,000+ legitimate and 1,000+ malicious packages. Based on this diverse data collection, we conducted a comparative analysis between legitimate and malicious packages. Our findings reveal that (1) malicious packages have less metadata content and utilize fewer static and dynamic functions than legitimate ones; (2) malicious packages demonstrate a higher tendency to invoke HTTP/URL functions as opposed to other application services, such as FTP or SMTP; (3) FGI serves as a distinguishable indicator between legitimate and malicious packages; and (4) one dimension in FGI has sufficient distinguishable capability to detect malicious packages, and combining all dimensions in FGI cannot significantly improve overall performance.