JavaSith: A Client-Side Framework for Analyzing Potentially Malicious Extensions in Browsers, VS Code, and NPM Packages

2025-05-27

AI Summary

Modern software supply chains face security threats from stealthy malware embedded within trusted components—such as browser extensions, VS Code plugins, and npm packages. To address this, we propose a lightweight, end-side collaborative analysis framework that pioneers the integration of a time-accelerated sandbox (“time machine”), static abstract syntax tree (AST) analysis, and locally deployed large language models (LLMs) for risk inference—enabling proactive triggering and identification of time-dependent malicious behaviors. Leveraging API-level runtime sandboxing, dynamic behavior interception, and semantic metadata parsing, the framework implements zero-trust pre-screening without requiring cloud connectivity or privileged execution. Evaluation demonstrates its effectiveness in detecting real-world, evasive threats—including Chrome extensions bypassing conventional antivirus (AV) and endpoint detection and response (EDR) systems, as well as cryptomining VS Code plugins—thereby significantly enhancing front-end supply chain security assurance.

Technology Category

• Application Domains: Security
• Machine Learning: Large Multimodal Models (LMMs)
• Computer Vision: Large Vision Models

Application Category

• Security and Privacy: Browser and end-point security
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

Modern software supply chains face an increasing threat from malicious code hidden in trusted components such as browser extensions, IDE extensions, and open-source packages. This paper introduces JavaSith, a novel client-side framework for analyzing potentially malicious extensions in web browsers, Visual Studio Code (VSCode), and Node's NPM packages. JavaSith combines a runtime sandbox that emulates browser/Node.js extension APIs (with a ``time machine'' to accelerate time-based triggers) with static analysis and a local large language model (LLM) to assess risk from code and metadata. We present the design and architecture of JavaSith, including techniques for intercepting extension behavior over simulated time and extracting suspicious patterns. Through case studies on real-world attacks (such as a supply-chain compromise of a Chrome extension and malicious VSCode extensions installing cryptominers), we demonstrate how JavaSith can catch stealthy malicious behaviors that evade traditional detection. We evaluate the framework's effectiveness and discuss its limitations and future enhancements. JavaSith's client-side approach empowers end-users/organizations to vet extensions and packages before trustingly integrating them into their environments.

Problem

• Detects malicious code in browser and IDE extensions
• Analyzes NPM packages for hidden security threats
• Combines sandbox emulation with static and LLM analysis

Innovation

• Client-side framework for analyzing malicious extensions
• Combines runtime sandbox, static analysis, and LLM
• Intercepts behavior over simulated time for detection