Decoding Maliciousness: LLM-Assisted Semantic Filtering for Scalable Malicious PyPI Package Detection

The Python Package Index (PyPI) has become a primary target for software supply chain attacks. Existing detection methods often rely on single-dimensional analysis, limiting their ability to support scalable detection in modern software ecosystems. This study presents a scalable framework for malicious PyPI package detection by combining graph centrality-based candidate identification with large language model semantic filtering. API interaction graphs are constructed from package source code, and four complementary centrality metrics are used to identify structurally important APIs. For each metric independently, a separate Top-K candidate pool is constructed and refined through semantic filtering with Qwen3.5-Plus, removing benign generic APIs while retaining security-sensitive APIs. The refined API features are further augmented with package-level metadata and used for package-level classification. Evaluations on a dataset of 20,743 packages (10,743 malicious and 10,000 benign) show that the proposed method achieves 96.3% precision, 95.9% recall, and a 96.1% F1-score. Ablation experiments indicate that semantic filtering provides the largest performance improvement, increasing F1-score by 4.2 percentage points over raw centrality features, while metadata augmentation provides a further improvement of 1.2 percentage points. The framework maintains robust detection performance under a highly imbalanced 1:50 class ratio and, after the one-time offline construction of the refined feature vocabulary, requires approximately 1 s per package for detection. A retrospective monitoring experiment on the PyPI release stream further demonstrates the practical applicability of the framework, while LIME provides interpretable evidence for the resulting predictions.