From the source
From the source
Databricks evaluates LLMs on binary malware triage and improves detection with domain-knowledge.
Databricks researchers studied LLM-based triage of npm packages containing bundled binaries, finding that binary-bearing packages fail to reach a decisive malicious verdict more than twice as often as source-only ones (14.4% vs 6.2%).
They developed capability profiles—declarative playbooks encoding malicious techniques—that inject structured evidence into prompts at inference time, improving detection across budget and frontier models without retraining.
From the source
Our analysis found packages with bundled binaries to be both the rarest and the hardest for the pipeline to triage. An adversary distributing malicious JavaScript can assume the target already has the runtime to execute the payload, whereas a binary must be compiled for a range of target machines. Across OSV-confirmed npm malware, binary-bearing packages fail to reach a decisive malicious verdict more than twice as often as source-only ones (14.4% vs 6.2%).
