On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI

Abstract

Current software supply chains heavily rely on open-source packages hosted in public repositories. Given the popularity of ecosystems like npm and PyPI, malicious users started to spread malware by publishing open-source packages containing malicious code.