Agentic Analysis of Open Source Package Code for Malware

Experiments with agentic workflows for malicious package analysis built using Claude Desktop, Model Context Protocol (MCP) server, static code analysis and SafeDep Cloud API tools. Demo Architecture For the demo, we exposed the following through an MCP Interface to MCP clients like Claude Desk Insights API Malicious Package Scanning API Misc tools for GitHub API access Misc tools for package registry (e.g. npm) access Looking Ahead While the results are promising and exciting for us but there is a long way to go to productionize this. For example, our automated systems that monitor public package registries use statically coded workflows and operate at < 10% time cost of the agentic execution currently. It also minimizes LLM calls by leveraging static code analysis and opinionated rules to scale much better. For proactive protection against malicious open source packages in CI/CD, try vet, its free and open source ➡️ https://github.com/safedep/vet

Apr 8, 2025 - 17:35

Agentic Analysis of Open Source Package Code for Malware

Experiments with agentic workflows for malicious package analysis built using Claude Desktop, Model Context Protocol (MCP) server, static code analysis and SafeDep Cloud API tools.

Demo

Architecture

For the demo, we exposed the following through an MCP Interface to MCP clients like Claude Desk

Insights API
Malicious Package Scanning API
Misc tools for GitHub API access
Misc tools for package registry (e.g. npm) access

Looking Ahead

While the results are promising and exciting for us but there is a long way to go to productionize this. For example, our automated systems that monitor public package registries use statically coded workflows and operate at < 10% time cost of the agentic execution currently. It also minimizes LLM calls by leveraging static code analysis and opinionated rules to scale much better.

For proactive protection against malicious open source packages in CI/CD, try vet, its free and open source

➡️ https://github.com/safedep/vet