# MOLOT System Card: Malicious Operational Logic Observation Transformer

arXiv: https://arxiv.org/abs/2606.07792 · HTML: https://mlsanity.com/paper/2606.07792/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 19 references that are in the map.
- First posted on arXiv 5 Jun 2026.

## Builds on (most cited first, 7 of 7)

- [Killing Two Birds with One Stone: Malicious Package Detection in NPM and PyPI using a Single Model of Malicious Behavior Sequence](https://mlsanity.com/paper/2309.02637/) (2023)
- [Leveraging Large Language Models to Detect npm Malicious Packages](https://mlsanity.com/paper/2403.12196/) (2024)
- [On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI](https://mlsanity.com/paper/2310.09571/) (2023)
- [DySec: A Machine Learning-based Dynamic Analysis for Detecting Malicious Packages in PyPI Ecosystem](https://mlsanity.com/paper/2503.00324/) (2025)
- [Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy?](https://mlsanity.com/paper/2504.13769/) (2025)
- [Unveiling Malicious Logic: Towards a Statement-Level Taxonomy and Dataset for Securing Python Packages](https://mlsanity.com/paper/2512.12559/) (2025)
- [How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study](https://mlsanity.com/paper/2603.27549/) (2026)

## Abstract (arXiv)

MOLOT (Malicious Operational Logic Observation Transformer) is a static malicious-code detection system designed for SAST setup where package metadata, maintainer history, and dynamic execution traces may be unavailable or unreliable. The system represents source code as behavior sequences derived from static call graphs, includes an explanation stage that ranks suspicious behavior activities and maps them back to source-code locations. The approach is evaluated on Python and JavaScript packages from PyPI and npm, compared with opensource detection tools, and validated under product constraints including runtime, memory use, and false-positive rates observed in a real moderation workflow. We also release Open Malicious-Code Bench, a public benchmark for reproducible evaluation of malicious-package detection methods. The results show that static behavior-sequence modeling can provide accurate, explainable, and deployable malicious-code detection for modern DevSecOps workflows.