一句话：提出 MPHunter，用代码聚类无先验地检测 PyPI 恶意安装脚本，两月发现 60 个新恶意包。
PyPI 的开源特性使其面临恶意包安全风险，已有检测方法依赖难以获取的显式知识（如污点源汇与恶意代码模式），易漏检新恶意包。本文提出轻量有效的 MPHunter，无需显式先验知识。它基于两个观察：恶意包远少于良性包；恶意包安装脚本的功能与良性包差异显著，后者常形成聚类。MPHunter 对安装脚本聚类并识别离群点，再按离群程度及与已知恶意实例的距离排序，突出潜在恶意包。在两个月的 31,329 个新上传包中，MPHunter 发现 60 个此前未知的恶意包，均获 PyPI 官方确认；人工分析表明其识别所有潜在恶意安装脚本的召回率为 100%。
As the most popular Python software repository, PyPI has become an indispensable part of the Python ecosystem. Regrettably, the open nature of PyPI exposes end-users to substantial security risks stemming from malicious packages. Consequently, the timely and effective identification of malware within the vast number of newly-uploaded PyPI packages has emerged as a pressing concern. Existing detection methods are dependent on difficult-to-obtain explicit knowledge, such as taint sources, sinks, and malicious code patterns, rendering them susceptible to overlooking emergent malicious packages. In this paper, we present a lightweight and effective method, namely MPHunter, to detect malicious packages without requiring any explicit prior knowledge. MPHunter is founded upon two fundamental and insightful observations. First, malicious packages are considerably rarer than benign ones, and second, the functionality of installation scripts for malicious packages diverges significantly from those of benign packages, with the latter frequently forming clusters. Consequently, MPHunter utilizes clustering techniques to group the installation scripts of PyPI packages and identifies outliers. Subsequently, MPHunter ranks the outliers according to their outlierness and the distance between them and known malicious instances, thereby effectively highlighting potential evil packages. With MPHunter, we successfully identified 60 previously unknown malicious packages from a pool of 31,329 newly-uploaded packages over a two-month period. All of them have been confirmed by the PyPI official. Moreover, a manual analysis shows that MPHunter recognizes all potentially malicious installation scripts with a recall of 100% across all analyzed packages. We assert that MPHunter offers a valuable and advantageous supplement to existing detection techniques, augmenting the arsenal of software supply chain security analysis.
@inproceedings{LiangLWLW23,
title = {A Needle is an Outlier in a Haystack: Hunting Malicious PyPI Packages with Code Clustering},
author = {Wentao Liang and Xiang Ling and Jingzheng Wu and Tianyue Luo and Yanjun Wu},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00085}
}