Detecting Insecure Software Updates at Scale with LLM Agents

A study of 3,006 open-source projects found 624 with software updaters capable of downloading and then installing, loading, or executing code, of which 49 relied on broken transport security, allowing a man-in-the-middle attacker to replace update payloads and achieve remote code execution on users' machines. The remaining updaters used a pinned signing key in 134 cases, enforced a publisher identity in 109, and relied only on HTTPS in 332, while 2,382 projects had no updater or were notification-only. The dataset and a public repository for inspecting and correcting the results were published by the study's author.