Using AI to Discover Silently Patched Vulnerabilities in Open...
summary
Monitoring 5 million packages, the system scrapes change logs, uses one LLM to standardize changelogs and a second LLM to flag ambiguous security fixes, cross-checks findings against NVD and GitHub advisories, and adds human verification. Over 2024 it finds ~550–600 silently patched issues, ~25% high/critical, with 67% never receiving CVEs and 56% of criticals undisclosed. Malware pipeline combines traditional scanners, 30+ indicators and an LLM triage, catching 611 malicious npm packages with ~5 minute median detection and <5% malware false positives; CVE detection false positive rate ~20%.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:02Open source supply chain risks
- 8:50Silent patching problem
- 12:00AI threat feed concept
- 15:34Research findings 2024
- 18:47Why disclosure matters now
- 21:14Malware detection launch
- 27:17Q&A session
related talks
16mPerformance improvements: exposing hidden security fixes in Open Source
28mOwn Goal: How AI Agents Are Quietly Scoring for the Other Side
01h 02mInside Today’s AI-Accelerated Software Supply Chain Attacks
37mPackage Vulnerability Management & Reporting Collaboration Space for...
29mWorms, Tokens, and Trust The Industrialization of Supply Chain Attacks
39mThe AI Arms Race in Vulnerability Management, Who’s Winning?
30mOpen Source Malware or a Vulnerability? The Philosophical Debate and How To Mitigate
33mYour Silent Software Saboteur: Open Source Malware