CROSSGUARD / PROPOSAL STAGE / OCTOBER 2026
Behind the verdict,
show the evidence.
My final year research investigates malicious npm and PyPI packages through security relevant program slicing, statement level localization and verifiable LLM explanations.
What makes this
package suspicious?
I’m exploring how to point to responsible source statements and check whether an explanation is supported by that code.
The work draws on a literature review of about 60 papers. The dataset approach deduplicates packages by SHA256 and separates package families between training and test data to reduce leakage.
The example beside this text is illustrative. It is not a live detector or a reported research result.
Choose a claim to inspect its evidence.
The illustrated chain links a read to an encoding step and then a send operation. Evidence: E01 to E03.
ILLUSTRATIVE EXAMPLE · NOT A LIVE SCAN
What I’m investigating
The proposed system brings package detection, statement level localization and explanation verification into one research project. The target registries are npm and PyPI.
What I’m using
Python, tree-sitter, pandas, scikit-learn and LLM APIs. Final detection and explanation results have not been established at this proposal stage.