# One Detector Fits All: Robust and Adaptive Detection of Malicious Packages from PyPI to Enterprises

arXiv: https://arxiv.org/abs/2512.04338 · HTML: https://mlsanity.com/paper/2512.04338/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 22 of its 46 references that are in the map.
- First posted on arXiv 3 Dec 2025.

## Builds on (most cited first, 22 of 22)

- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning](https://mlsanity.com/paper/1712.03141/) (2017)
- [Model Evaluation, Model Selection, and Algorithm Selection in Machine Learning](https://mlsanity.com/paper/1811.12808/) (2018)
- [Dos and Don'ts of Machine Learning in Computer Security](https://mlsanity.com/paper/2010.09470/) (2020)
- [Functionality-preserving Black-box Optimization of Adversarial Windows Malware](https://mlsanity.com/paper/2003.13526/) (2020)
- [Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection](https://mlsanity.com/paper/1704.08996/) (2017)
- [An Empirical Study of Malicious Code In PyPI Ecosystem](https://mlsanity.com/paper/2309.11021/) (2023)
- [Killing Two Birds with One Stone: Malicious Package Detection in NPM and PyPI using a Single Model of Malicious Behavior Sequence](https://mlsanity.com/paper/2309.02637/) (2023)
- [Nebula: Self-Attention for Dynamic Malware Analysis](https://mlsanity.com/paper/2310.10664/) (2023)
- [A Benchmark Comparison of Python Malware Detection Approaches](https://mlsanity.com/paper/2209.13288/) (2022)
- [DONAPI: Malicious NPM Packages Detector using Behavior Sequence Knowledge Mapping](https://mlsanity.com/paper/2403.08334/) (2024)
- [Leveraging Large Language Models to Detect npm Malicious Packages](https://mlsanity.com/paper/2403.12196/) (2024)
- [On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI](https://mlsanity.com/paper/2310.09571/) (2023)
- [SLIFER: Investigating Performance and Robustness of Malware Detection Pipelines](https://mlsanity.com/paper/2405.14478/) (2024)
- [Towards Robust Detection of Open Source Software Supply Chain Poisoning Attacks in Industry Environments](https://mlsanity.com/paper/2409.09356/) (2024)
- [Raze to the Ground: Query-Efficient Adversarial HTML Attacks on Machine-Learning Phishing Webpage Detectors](https://mlsanity.com/paper/2310.03166/) (2023)
- [Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy?](https://mlsanity.com/paper/2504.13769/) (2025)
- [Using the Uniqueness of Global Identifiers to Determine the Provenance of Python Software Source Code](https://mlsanity.com/paper/2305.14837/) (2023)
- [The Hitchhiker's Guide to Malicious Third-Party Dependencies](https://mlsanity.com/paper/2307.09087/) (2023)
- [ModSec-AdvLearn: Countering Adversarial SQL Injections with Robust Machine Learning](https://mlsanity.com/paper/2308.04964/) (2023)
- [Malicious Package Detection using Metadata Information](https://mlsanity.com/paper/2402.07444/) (2024)

## Abstract (arXiv)

The rise of supply chain attacks via malicious Python packages demands robust detection solutions. Current approaches, however, overlook two critical challenges: robustness against adversarial source code transformations and adaptability to the varying false positive rate (FPR) requirements of different actors, from repository maintainers (requiring low FPR) to enterprise security teams (higher FPR tolerance). We introduce a robust detector capable of seamless integration into both public repositories like PyPI and enterprise ecosystems. To ensure robustness, we propose a novel methodology for generating adversarial packages using fine-grained code obfuscation. Combining these with adversarial training (AT) enhances detector robustness by 2.5x. We comprehensively evaluate AT effectiveness by testing our detector against 122,398 packages collected daily from PyPI over 80 days, showing that AT needs careful application: it makes the detector more robust to obfuscations and allows finding 10% more obfuscated packages, but slightly decreases performance on non-obfuscated packages. We demonstrate production adaptability of our detector via two case studies: (i) one for PyPI maintainers (tuned at 0.1% FPR) and (ii) one for enterprise teams (tuned at 10% FPR). In the former, we analyze 91,949 packages collected from PyPI over 37 days, achieving a daily detection rate of 2.48 malicious packages with only 2.18 false positives. In the latter, we analyze 1,596 packages adopted by a multinational software company, obtaining only 1.24 false positives daily. These results show that our detector can be seamlessly integrated into both public repositories like PyPI and enterprise ecosystems, ensuring a very low time budget of a few minutes to review the false positives. Overall, we uncovered 346 malicious packages, now reported to the community.