  Package managers such as NPM, Maven, and PyPI play a pivotal role in
open-source software (OSS) ecosystems, streamlining the distribution and
management of various freely available packages. The fine-grained details
within software packages can unveil potential risks within existing OSS
ecosystems, offering valuable insights for detecting malicious packages. In
this study, we undertake a large-scale empirical analysis focusing on
fine-grained information (FGI): the metadata, static, and dynamic functions.
Specifically, we investigate the FGI usage across a diverse set of 50,000+
legitimate and 1,000+ malicious packages. Based on this diverse data
collection, we conducted a comparative analysis between legitimate and
malicious packages. Our findings reveal that (1) malicious packages have less
metadata content and utilize fewer static and dynamic functions than legitimate
ones; (2) malicious packages demonstrate a higher tendency to invoke HTTP/URL
functions as opposed to other application services, such as FTP or SMTP; (3)
FGI serves as a distinguishable indicator between legitimate and malicious
packages; and (4) one dimension in FGI has sufficient distinguishable
capability to detect malicious packages, and combining all dimensions in FGI
cannot significantly improve overall performance.
