Research
Closing the Binary Blind Spot: Domain-Knowledge Injection for LLM Malware Triage in npm Packages
Publication date unknown · Discovered databricks.com
Page published
Publication date unknown · First observed: 2 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
LLM-based package triage can overlook opaque compiled payloads behind benign-looking source and metadata, making binary-analysis evidence important for reliable malicious-package detection.
Databricks evaluated LLM malware triage using crafted native Node.js addons bundled within otherwise clean npm packages, testing whether precomputed binary-analysis evidence improves detection. In its OSV-corroborated dataset, binary-bearing packages failed to receive a decisive malicious verdict 14.4% of the time, versus 6.2% for source-only packages.