From single pull requests to full software packages: Detecting malicious code at scale

The article describes the expansion of BewAIre, an LLM-based security system, from analyzing pull requests to scanning entire dependency packages for malicious code. The updated system utilizes a two-stage pipeline consisting of an inexpensive "filter" phase for rapid screening, followed by an agentic investigation loop that uses high-powered models and external tools to deep-dive into suspicious flags. This approach significantly increased detection accuracy to 99.86% and eliminated false positives while maintaining operational efficiency and cost-effectiveness.