This empirical analysis investigates the detection of malicious packages in the NPM ecosystem, which has become increasingly targeted by software supply chain attacks. A dataset of 6,420 malicious and 7,288 benign packages was created, categorizing behaviors across 11 types and evaluating eight detection tools. Key findings include that GuardDog achieved the highest balance in performance with a 93.32% F1 score, and effective tool combination strategies can reach accuracies of 96.08%. The analysis also highlights that the lack of mandatory scanning allows most malware to operate without evasion techniques.
