MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories

2026-08-04

AI Summary

Existing malware detection approaches are hindered by strong language dependency, limited generalization across programming languages, and high analysis costs, making them impractical for large-scale security scanning of multilingual open-source repositories. To address these challenges, this work proposes MalTotal, a novel framework that leverages large language models to infer sensitive API usage through semantic reasoning and reconstructs malicious behavior contexts via hybrid semantic slicing. This enables language-agnostic detection while significantly enhancing cross-language generalization. Experimental results demonstrate that MalTotal achieves an average F1 score of 93.1% across five major programming languages, reduces per-repository analysis cost by 94%—from \$86.25 to \$5.19—and successfully identified 564 previously unknown malicious repositories among 120,000 GitHub repositories at a total cost of \$338.

Abstract

The widespread adoption of open source software (OSS) has introduced significant security risks, with malicious code poisoning attacks increasingly targeting public package registries and open-source platforms. Existing detection approaches, including heuristic-, learning-, and LLM-based methods, suffer from language-specific designs, limited generalization, and high analysis costs, making them unsuitable for large-scale multi-language analysis. To address these challenges, we propose MalTotal, a scalable and cost-effective framework for language-agnostic malicious code detection. MalTotal leverages LLM-assisted semantic reasoning to identify sensitive APIs, perform hybrid semantic slicing, and reconstruct malicious behavior contexts while reducing analysis overhead. Our evaluations show that MalTotal outperforms 8 state-of-the-art baselines, achieving an average F1-score of 93.1% across 5 mainstream languages. Its hybrid slicing reduces LLM token consumption by 94.0%, lowering the analysis cost from \$86.25 to \$5.19 on 2,168 repositories. In a large-scale study of 120K GitHub repositories containing over 7.3 million files, MalTotal discovered 564 previously unknown malicious repositories across multiple languages at a total cost of \$338. These results demonstrate the effectiveness, scalability, and cost-efficiency of MalTotal in mitigating large-scale code poisoning attacks.

Problem

• malicious code poisoning
• language-agnostic detection
• large-scale analysis
• open source security
• cost-effective detection

Innovation

• language-agnostic
• malicious code poisoning
• LLM-assisted semantic reasoning
• hybrid semantic slicing
• cost-effective detection