Towards the Detection of Malicious Java Packages - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2022

Towards the Detection of Malicious Java Packages

Henrik Plate
  • Function : Author
Matias Martinez
Olivier Barais
Serena Elisa Ponta
  • Function : Author
  • PersonId : 1211374


Open-source software supply chain attacks aim at infecting downstream users by poisoning open-source packages. The common way of consuming such artifacts is through package repositories and the development of vetting strategies to detect such attacks is ongoing research. Despite its popularity, the Java ecosystem is the less explored one in the context of supply chain attacks. In this paper, we present simple-yet-effective indicators of malicious behavior that can be observed statically through the analysis of Java bytecode. Then we evaluate how such indicators and their combinations perform when detecting malicious code injections. We do so by injecting three malicious payloads taken from realworld examples into the Top-10 most popular Java libraries from We found that the analysis of strings in the constant pool and of sensitive APIs in the bytecode instructions aid in the task of detecting malicious Java packages by significantly reducing the information, thus, making also manual triage possible. CCS CONCEPTS • Security and privacy → Malware and its mitigation.
Fichier principal
Vignette du fichier
3560835.3564548.pdf (1.11 Mo) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03921362 , version 1 (03-01-2023)




Piergiorgio Ladisa, Henrik Plate, Matias Martinez, Olivier Barais, Serena Elisa Ponta. Towards the Detection of Malicious Java Packages. CCS 2022 - ACM SIGSAC Conference on Computer and Communications Security, Nov 2022, Los Angeles CA USA, United States. pp.63-72, ⟨10.1145/3560835.3564548⟩. ⟨hal-03921362⟩
37 View
205 Download



Gmail Mastodon Facebook X LinkedIn More