Scaling malicious code detection from pull requests to the software supply chain | Datadog

This post details the expansion of Datadog's BewAIre system from detecting malicious code in pull requests to scanning entire dependency packages and upstream package registries. The core technical contribution is the implementation of a two-stage evaluation pipeline: a fast, inexpensive filter phase using a previous-generation or high-speed LLM, followed by a more thorough agentic investigation phase for flagged changes. The investigation phase utilizes tools to gather additional context, such as GitHub API calls for commit history, contributor analysis, and dependency validation against external resources. The post highlights engineering trade-offs in scaling malicious code detection across ecosystems while maintaining high accuracy and operational efficiency, including a preprocessing pipeline for domain typosquatting checks.