# MOLOT System Card: Malicious Operational Logic Observation Transformer Source: [MOLOT System Card: Malicious Operational Logic Observation Transformer]() Collection index: [llms.txt]() Data updated: 2026-06-10T05:00:46.690Z Authors: Daniil Lopatkin, Maksim Mitrofanov, Stanislav Rakovsky, Aleksandr Khalikov Published: 2026-06-05T19:10:31.000Z ## Abstract MOLOT (Malicious Operational Logic Observation Transformer) is a static malicious-code detection system designed for SAST setup where package metadata, maintainer history, and dynamic execution traces may be unavailable or unreliable. The system represents source code as behavior sequences derived from static call graphs, includes an explanation stage that ranks suspicious behavior activities and maps them back to source-code locations. The approach is evaluated on Python and JavaScript packages from PyPI and npm, compared with opensource detection tools, and validated under product constraints including runtime, memory use, and false-positive rates observed in a real moderation workflow. We also release Open Malicious-Code Bench, a public benchmark for reproducible evaluation of malicious-package detection methods. The results show that static behavior-sequence modeling can provide accurate, explainable, and deployable malicious-code detection for modern DevSecOps workflows. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [File-level Malicious Code Detection on Malicious Package Python (val)](): File-level Malicious Code Detection; Malicious Package Python, File-level (val); Precision: 84.6. - [Malicious Code Detection on Public Benchmark Python, File-level](): Malicious code detection; Public Benchmark Python, File-level; Precision: 84.9. - [Malicious Code Detection on Open Malicious-code Bench Public Subset Python (Package-level)](): Malicious code detection; Open Malicious-code Bench Public Subset Python (Package-level); Precision: 89.6. - [Package-level evaluation on Python Full (val)](): Package-level evaluation; Python Full (val); Precision: 92.4. - [File-level Malicious Code Detection on Malicious Package JavaScript (full val)](): File-level Malicious Code Detection; Malicious Package JavaScript, File-level (full val); Precision: 90.8. - [Malicious code detection on Public Benchmark Subset JavaScript File-level](): Malicious code detection; Public Benchmark Subset JavaScript File-level; Precision: 83.8. - [Malicious Code Detection on Open Malicious-code Bench Public Subset JavaScript Package-level](): Malicious code detection; Open Malicious-code Bench Public Subset JavaScript Package-level; Precision: 91.2. - [Package-level evaluation on JavaScript (val)](): Package-level evaluation; JavaScript (val); Precision: 96.4. ## Original sources and implementation [Original paper]() [PDF]()