DistillGuard: Malicious NPM Package Detection and API Attack Chain Analysis via Static Graph and LLM Distillation

What it is

DistillGuard is a malicious NPM package detector from researchers at the Institute of Information Engineering, Chinese Academy of Sciences. The page's actionable content beyond the summary is two concrete case studies and the three-part static analysis pipeline design.

How it works

Three static analysis modules feed structured evidence to an online LLM for distillation, which then trains the offline Qwen3-8B student via LoRA:

1. Package.json Configuration Parser — scans lifecycle hook fields (preinstall, postinstall, preuninstall) and custom scripts for abnormal automated execution logic.
2. Dependency Import Parser — AST-based traversal of require()/import statements, flagging sensitive system-level modules (network, file I/O, system info, command execution).
3. API Call Graph Analyzer — uses the Jelly static analysis tool (with custom secondary development) to build fine-grained function call graphs, reconstructing execution chains of sensitive APIs including conditionally-triggered behavior that rule-based tools miss.

Two real malicious packages illustrate the attack-chain concept the paper catalogs:

• nodexda: a postinstall script in package.json runs index.js, which uses https.get to fetch a DNS TXT record from dkoqwdkoqk.duckdns.org, parses JSON from the response, and passes an extracted field to child_process.exec — a C2 pattern where remote content becomes an executed shell command.
• @superbet-group/web.lib.vue-utilities: a typosquat-style fake Vue utility library with no suspicious lifecycle scripts (evading install-phase checks). Instead, its index.js entry point runs a self-executing function on import/require that spawns /bin/sh via child_process and pipes its stdio through a net socket connected to 207.154.222.173:4444 — a classic reverse shell.

flowchart TD
    A[npm install] --> B{Hook script present?}
    B -->|Yes: postinstall| C[nodexda: fetch DNS TXT from<br/>dkoqwdkoqk.duckdns.org]
    C --> D[child_process.exec remote payload]
    B -->|No hooks, evades install checks| E[import/require triggers index.js]
    E --> F[superbet-group pkg: spawn /bin/sh]
    F --> G[net socket to 207.154.222.173:4444]
    G --> H[Reverse shell: stdio piped to attacker]

Preconditions / Affected

The nodexda chain requires the victim to run npm install (triggers postinstall automatically, no user action needed). The @superbet-group/web.lib.vue-utilities chain triggers merely on import/require of the module — it has no install-time hooks, so it specifically evades detection tools that only check lifecycle scripts.

Caveats

Both are presented as illustrative case studies from the paper's dataset, not newly disclosed incidents with disclosed dates — the page gives no discovery date or npm registry removal status for either package. The Jelly call-graph tool is described as requiring "customized secondary development," so the described capability isn't available out-of-the-box from the public @cs-au-dk/jelly package.