---
title: "npm"
description: "1 posts about npm, summarised, each linking to the original."
---

# npm
> 1 posts about npm, summarised, each linking to the original.

## Articles

### [Closing the Binary Blind Spot: Domain-Knowledge Injection for LLM Malware Triage in npm Packages](https://yomu.fyi/post/closing-the-binary-blind-spot-domain-knowledge-injection-for-llm-malwa.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Databricks Threat Research
- Published: Oct 16, 2026
- Type: Problem & solution

Supply chain attacks on the npm registry are growing, and packages that bundle a binary payload are rare but disproportionately hard for LLMs to triage. The authors built a scanner that combines static analysis with LLM reasoning and introduced capability profiles, which encode malicious techniques as weighted conditions injected into the prompt before the model decides. They tested nine models across seven providers on five adversarial payload types, including credential stealers and reverse shells, at varying obfuscation levels. Without profiles, the budget-tier models failed to reach a malicious verdict on 50 percent of tests, with failures following distinct model-specific patterns rather than random error. With profiles enabled, the failure rate dropped to 4 percent, and 91 percent of prior failures recovered to a detection.