It's still happening, and the Sophos log identifies the culprit as:

com.sophos.oas: 2018-01-01 11:43:07 +0200 Threat: 'Mal/DrodZp-A' detected in '/Users/Shared/GOG.com/Galaxy/autoupdate/desktop-galaxy-client/Contents/Resources/web/scripts/desktopNotificat ionsOur.js.zip'

Now that I found the reason for the false positives, I realized I can put it in the Excluded Items list in Sophos preferences, so now updating works fine.