MOLOT (Malicious Operational Logic Observation Transformer) is a static malicious-code detection system designed for SAST setup where package metadata, maintainer history, and dynamic execution traces may be unavailable or unreliable. The system represents source code as behavior sequences derived from static call graphs, includes an explanation stage that ranks suspicious behavior activities and maps them back to source-code locations. The approach is evaluated on Python and JavaScript packages from PyPI and npm, compared with opensource detection tools, and validated under product constraints including runtime, memory use, and false-positive rates observed in a real moderation workflow. We also release Open Malicious-Code Bench, a public benchmark for reproducible evaluation of malicious-package detection methods. The results show that static behavior-sequence modeling can provide accurate, explainable, and deployable malicious-code detection for modern DevSecOps workflows.

翻译：MOLOT（恶意操作逻辑观察变换器）是一个为静态应用安全测试环境设计的静态恶意代码检测系统，适用于包元数据、维护者历史记录及动态执行轨迹可能不可用或不可靠的场景。该系统将源代码表示为从静态调用图推导出的行为序列，并包含一个解释阶段，用于对可疑行为活动进行排序并将其映射回源代码位置。该方法在PyPI和npm的Python与JavaScript包上进行了评估，与开源检测工具进行了比较，并在真实审核工作流中对运行时、内存使用及误报率等产品约束条件下进行了验证。我们还发布了开放恶意代码基准，这是一个用于可重复评估恶意包检测方法的公开基准。结果表明，静态行为序列建模能够为现代DevSecOps工作流提供准确、可解释且可部署的恶意代码检测。