Högskolan i Skövde

Software supply chain attacks, where malicious code is inserted into software components or repositories, present a growing threat to the open-source ecosystem. Traditional scanning methods often fail to detect hidden threats. Machine Learning (ML) offers a potential solution by automating the detection of malicious packages. However, previous studies report false positive rates too high for practical deployment. This study investigates whether increasing feature quantity improves ML model performance for detecting malicious software packages on PyPI. Using aquasi-experiment with Decision Tree, Random Forest, and XGBoost classifiers, the feature set is incrementally expanded, and performance changes are measured. Results show that while adding features improves performance initially, there are diminishing gains beyond a certain point. Future work includes expanding feature sets further and adding additional randomized datasets to reduce feature bias.