Obvious way to do this would be with some variation of ranking the edit distance or simple entropy differences, and alerting/prioritizing significant updates fo

Obvious way to do this would be with some variation of ranking the edit distance or simple entropy differences, and alerting/prioritizing significant updates for further scrutiny in another workflow pipeline. Bug fixes are relatively low distace, where a new module would show up as a bump. It would FP on code cleanups, but who actually does those. There are more sophisticated methods than these used in products today, but this is something an amateur could implement. Compute is huge, but cost/benefit is a product problem. Some string searches would be easy wins as well, given wallet file names, detecting new public keys, etc. Can think of a few AV products that would benefit users by being able to state an app has added an update that resembles a new module with functionality they might not have signed up for in the original EULA. If you are an enterprise customer, I'd ask your AV vendor for it as a feature. Realistically, the best control is don't put a cryptocurrency wallet on a device that has automatic updates from untrusted sources.