Many hands make light work: An LLM-based multi-agent system for detecting malicious PyPI packages

2026-01-17

Journal of Systems and Software

AI Summary

This work proposes LAMPS, a multi-agent collaborative system based on large language models (LLMs) to detect malicious packages in the PyPI repository that exhibit strong semantic obfuscation and evade traditional rule-based detection methods. LAMPS employs a modular architecture coordinated via the CrewAI framework, integrating four specialized agents that synergistically combine fine-tuned CodeBERT for classification and LLaMA-3 for contextual reasoning. This approach enables high-precision, interpretable, and scalable supply chain security analysis. Evaluated on the D1 and D2 datasets, LAMPS achieves accuracy rates of 97.7% and 99.5%, respectively, significantly outperforming baseline methods including MPHunter, retrieval-augmented generation (RAG), and single-agent approaches, thereby overcoming the limitations of individual models in recognizing complex malicious behavioral patterns.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Multiagent Systems: Coordination and Collaboration
• Natural Language Processing: Safety and Robustness

Application Category

• Search and Retrieval-Augmented AI: Agentic search
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Problem

• malicious code detection
• software supply chain security
• PyPI packages
• open-source repositories
• adversarial components

Innovation

• multi-agent system
• large language models
• malicious package detection
• software supply chain security
• modular LLM reasoning