cid 6cb01f8beab3c64982af2570409042d908c233b3079dec9e00e94d418e876401 · original · open access · via openalex
Title: Poster: Using CodeQL to Detect Malware in npm Authors: Matías F. Gobbi; Johannes Kinder Venue: ACM SIGSAC Conference on Computer and Communications Security (CCS) Year: 2023 Canonical: doi:10.1145/3576915.3624401 URL: https://doi.org/10.1145/3576915.3624401 Collector: openalex OA: true ABSTRACT Malicious packages are a problem on npm, but like other malware, they are rarely completely novel and share large semantic similarities. We propose to leverage the existing static analysis framework CodeQL to find malware on npm; but instead of detecting variants of vulnerabilities, we use it to detect variants of malware. We present a methodology for writing queries from recently reported packages, as a way of defining semantic signature for specific malicious behavior, where a single one can then be used to match entire families of malware. An iteration of our approach resulted in the discovery of 125 malicious packages from the registry, without producing a single false alarm.