Vulnerability detection in software source code is crucial in ensuring software security. Existing models face challenges with dataset class imbalance and long training times. To address these issues, this paper introduces a multi-feature screening and integrated sampling model (MFISM) to enhance vulnerability detection efficiency and accuracy. The key innovations include (i) utilizing abstract syntax tree (AST) representation of source code to extract potential vulnerability-related features through multiple feature screening techniques; (ii) conducting analysis of variance (ANOVA) and evaluating feature selection techniques to identify representative and discriminative features; (iii) addressing class imbalance by applying an integrated over-sampling strategy to create synthetic samples from vulnerable code to expand the minority class sample size; (iv) employing outlier detection technology to filter out abnormal synthetic samples, ensuring high-quality synthesized samples. The model employs a bidirectional long short-term memory network (Bi-LSTM) to accurately identify vulnerabilities in the source code. Experimental results demonstrate that MFISM improves the F1 score performance by approximately 10% compared to existing DeepBalance methods and reduces the training time to 2–3 h. These results confirm the effectiveness and superiority of MFISM in source code vulnerability detection tasks.

With the widespread use of open-source components in modern software development, reusing third-party code improves development efficiency while also intensifying security risks in the software supply chain. As the largest open-source package registry in the world, NPM (Node Package Manager) has become a primary target for supply chain attacks. Existing methods for detecting malicious NPM packages face two main challenges. First, traditional program graphs used to represent source code (e.g., Abstract Syntax Tree (AST) and Call Graph (CG)) have limited capability in characterizing malicious behaviors inside code, thereby affecting analysis efficiency and detection accuracy. Second, matching rules for identifying malicious packages mostly rely on manual definition. This process is time-consuming and labor-intensive, and the accuracy of these rules needs improvement. To address these challenges, this paper proposes the PDCG-RuleDetector framework to detect malicious NPM packages. First, this paper uses the proposed Parameterized Data-flow Call Graph (PDCG) to represent script files in NPM packages, and leverages a Large Language Model (LLM) to automatically extract sensitive behavior matching rules from malicious NPM packages, constructing a sensitive behavior matching rule library. Then, this paper marks sensitive nodes in the PDCG according to the rules in the rule library, generates feature vectors from the PDCG, and trains a classifier to detect malicious NPM packages. The effectiveness of the PDCG-RuleDetector framework is validated on widely used datasets. On the MalnpmDB dataset, the proposed model achieves an F1 score of 96.2%, which is better than existing detection methods. On the Robust and Datadog datasets, the F1 scores are 91.2% and 94.9%, respectively. These results show good generalization capability. More importantly, during 10 days of real-world deployment, the framework identified 152 malicious packages among 107,802 newly published NPM packages. All of them were verified and removed by the official NPM security team.