Databricks Finds LLMs Miss Malware Hidden in npm Binary Files
Databricks Threat Research says LLMs often fail to flag npm malware hidden in compiled binaries, and that injecting structured threat evidence into prompts recovers most of the missed detections.
Quick answer
What did Databricks' research team find about LLMs detecting malware hidden in npm package binaries?
Databricks Threat Research says LLMs used to triage npm packages often miss malware hidden in compiled binaries, failing half of its budget-tier tests outright. The company says injecting structured "capability profile" evidence into prompts before models reason recovered 91% of those failures across its tested models.
Key takeaways
- Databricks Threat Research says npm packages that bundle compiled binaries evade decisive malware verdicts more than twice as often as packages hiding malicious code in visible source (14.4% versus 6.2%, by the company's count).
- Databricks tested nine LLMs from seven providers and found its seven-model budget tier failed 35 of 70 malware detection tests without added guidance, including 20 packages rated outright benign.
- The company's "capability profile" system injects roughly 1,800 tokens of structured static-analysis evidence into a model's prompt before it renders a verdict, and Databricks says this resolved 32 of the 35 original budget-tier failures.
- In one specific test Databricks describes, Qwen3-Next 80B rated an obfuscated credential-stealing package "benign" with 98% confidence without the added evidence, then rated the identical package "malicious" with 98% confidence once capability profiles were applied.
- Databricks says GPT-5.4-nano remained the weakest performer even with capability profiles added, still falling short of a malicious verdict on three of ten test payloads.
What Databricks found
Databricks Threat Research says it has been collecting malware samples from the npm package registry since November 2025. Of 11,413 package-versions it scanned and corroborated against OSV npm malware advisories, the company says 96.2% hid their malicious payload directly in source code or fetched it from an external server. The remaining 3.8%, or 432 package-versions, bundled a compiled binary instead.
According to Databricks, binary-bearing packages are harder to triage even though they are rarer. The company says that across OSV-confirmed npm malware, packages shipping a binary failed to reach a decisive malicious verdict more than twice as often as source-only packages, 14.4% versus 6.2%.
How the test was built
Databricks built a scanner that monitors the npm registry in real time, running YARA and Semgrep against package code and metadata alongside a binary-analysis module, before passing the assembled evidence to an LLM for a verdict.
To probe binary-based detection specifically, the researchers created five adversarial package types built as native Node.js addons: a credential-stealing package called sysmon-native, a dropper/backdoor named buildchain-native, a reverse shell called netpulse-native, a cryptominer stub named hashworker-native, and a persistence mechanism called taskd-native. Each was packaged with a professional-looking package.json, README, and JavaScript bindings.
Databricks tested nine models from seven providers: a seven-model "budget" tier it says teams would realistically deploy at scale, plus two higher-capability models, Claude Sonnet 4.6 and Kimi K3, used as behavioral baselines, and Claude Opus 4.6, included only as a cost reference.
Results
| Model | Without profiles | With profiles |
|---|---|---|
| GPT-5.4-nano | 0/10 | 7/10 |
| Qwen3-Next 80B | 1/10 | 10/10 |
| Llama 3.1 8B | 4/10 | 10/10 |
| Gemma 3 12B | 5/10 | 10/10 |
| Claude Haiku 4.5 | 6/10 | 10/10 |
| GLM 5.3 Flash | 9/10 | 10/10 |
| Gemini 3.5 Flash | 10/10 | 10/10 |
Without extra guidance, Databricks says the budget tier failed 35 of 70 detection tests (50%), including 20 cases where a model rated malware outright benign, and fell short of a "malicious" verdict in 51 of 70 tests (73%). The two baseline models did not fail at the detection threshold and fell short of a malicious verdict only once, the company says.
Databricks says it addressed this with what it calls "capability profiles": declarative playbooks that score static scan evidence against thresholds tied to a specific malicious technique, such as credential harvesting or persistence. When a threshold is met, the system injects a roughly 1,800-token structured summary into the model's prompt before it reasons, though the model can still override the profile's findings.
With profiles added, Databricks says 32 of the 35 original failures (91%) turned into correct detections, and no model returned a benign verdict on any tested payload. Failures at the detection threshold across the budget tier fell from 50% to 4% (3 of 70 tests), and shortfalls at the malicious bar fell from 73% to 34%. GPT-5.4-nano's three remaining failures landed at "suspicious" rather than benign.
The company highlighted one case in detail: Qwen3-Next 80B rated an obfuscated version of the sysmon-native stealer package benign with 98% confidence and recommended allowlisting it when no profile applied. On the identical package, once four capability profiles fired, the same model rated it malicious with 98% confidence and recommended blocking it.
Frequently asked questions
- What problem did Databricks' research address?
- Databricks Threat Research examined why LLMs used to triage potentially malicious npm packages often fail to detect malware hidden inside compiled binary files rather than in visible source code.
- How many models did Databricks test, and what happened without added guidance?
- Databricks tested nine models from seven providers. Without added guidance, its seven-model budget tier failed 35 of 70 detection tests, including 20 cases rated outright benign, according to the company.
- What is a capability profile, according to Databricks?
- Databricks describes it as a declarative playbook that scores static scan evidence against thresholds tied to a specific malicious technique, injecting a roughly 1,800-token structured summary into the model's prompt when a threshold is met.
- Did capability profiles fix all the detection failures Databricks found?
- No. Databricks says profiles resolved 32 of 35 budget-tier failures, but GPT-5.4-nano still returned suspicious rather than malicious verdicts on three of its ten test payloads.