{"slug": "vigilance-catch-supply-chain-attacks-without-the-noise-or-the-work", "title": "Vigilance – Catch supply chain attacks without the noise or the work", "summary": "Vigilance, a new software supply chain security tool from Vigilance HQ, detects poisoned updates by flagging files that gain new capabilities, without using AI, CVE databases, or dependencies, and works offline on Pro. The tool, which requires no setup beyond pointing it at a folder, would have caught major attacks including SolarWinds 2020 (18,000 networks), 3CX 2023 (600,000 companies), XZ Utils 2024, event-stream 2018, Codecov 2021, and ua-parser-js 2021.", "body_md": "Software supply chain security\n\n# Catch supply chain attacks without the noise.\n\nA poisoned update looks normal. Vigilance flags the one file that gained a new power, before you install it.\n\nNo AI *|* No CVE Database *|*\n\nNo Dependencies *|* Offline on Pro\n\n```\ncurl -fsSL https://vigihq.com/install.sh | sh\n```\n\n[read the installer before you pipe it](/verify#installer)\n\n0 installations\n\n## Point it at a folder. That is it.\n\nThe first run learns the folder. Every run after shows what changed. Nothing to set up.\n\n## Where attacks hide, and where we watch\n\nA bad change has to travel. It can be planted in the source, slip in through a library, ride your build, become a release, and land on a machine. It can be a poisoned library like event-stream, a build like SolarWinds, or a signed update like 3CX. Put Vigilance anywhere along the chain and it catches the change before it runs, even on a box with no network, on Pro.\n\n### Compatible on any machine\n\n**We watch the whole chain, on any machine.** We do not lint your code or catch logic\nbugs. Code quality is not our job. We look for one thing: a file that gains a power it\nnever had. So we catch the change that can do something new: a poisoned source\nfile, a dependency, a build step, an install hook, a package or a binary. Start from a\nversion you trust.\n\n## What you would have seen\n\nEach of these updates was signed and real. The other files looked normal. This is what Vigilance prints when you compare the version you trust against the poisoned one. Open a row to read it.\n\n## SolarWinds 2020 A signed update. 18,000 networks installed it.\n\n``` bash\n$ vigi diff --old orion-2019.4.5200-9083 --new orion-2020.2.1\n\nvigi\nFiles Scanned: 18,342 (1 Added)\n\nHEADS UP  1 file can now do things the old version could not.\n\nCHANGED    Orion.Core.BusinessLayer.dll\n           It now runs other programs. It did not before.\n           It now talks to avsvmcloud.com. It did not before.\n           The change is in its compiled code, not only its data.\n```\n\n## 3CX 2023 A signed installer. It shipped to 600,000 companies.\n\n``` bash\n$ vigi diff --old 3cxdesktopapp-18.12.407 --new 3cxdesktopapp-18.12.416\n\nvigi\nFiles Scanned: 1,204\n\nHEADS UP  2 files can now do things the old version could not.\n\nCHANGED    ffmpeg.dll\n           It now scrambles or unscrambles data. It did not before.\n           The change is in its compiled code, not only its data.\n\nCHANGED    d3dcompiler_47.dll\n           It now downloads something and runs it straight away. It did not before.\n```\n\n## XZ Utils 2024 A backdoor headed for every major Linux.\n\n``` bash\n$ vigi diff --old xz-5.4.6 --new xz-5.6.1\n\nvigi\nFiles Scanned: 414 (3 Added)\n\nHEADS UP  1 file can now do things the old version could not. 2 more changed and can do nothing new.\n\nCHANGED    liblzma.so.5.6.1\n           It now writes into another running program. It did not before.\n           The change is in its compiled code, not only its data.\n```\n\n## event-stream 2018 A package millions of apps pulled in each week.\n\n``` bash\n$ vigi diff --old event-stream-3.3.5 --new event-stream-3.3.6\n\nvigi\nFiles Scanned: 12 (2 Added)\n\nHEADS UP  1 file can now do things the old version could not.\n\nNEW FILE   node_modules/flatmap-stream/index.min.js\n           It handles crypto keys and scrambles or unscrambles data.\n```\n\n## Codecov 2021 One line changed. Thousands of pipelines ran it.\n\n``` bash\n$ vigi diff --old codecov-bash.old --new codecov-bash.new\n\nvigi\nFiles Scanned: 1\n\nHEADS UP  1 file can now do things the old version could not.\n\nCHANGED    codecov\n           It now reads saved passwords and access keys. It did not before.\n           It now talks to 104.248.94.23. It did not before.\n```\n\n## ua-parser-js 2021 Downloaded millions of times a week.\n\n``` bash\n$ vigi diff --old ua-parser-js-0.7.28 --new ua-parser-js-0.7.29\n\nvigi\nFiles Scanned: 28 (2 Added)\n\nHEADS UP  2 files can now do things the old version could not.\n\nNEW FILE   preinstall.sh\n           Runs during an install or a build.\n           It downloads something and runs it straight away.\n\nNEW FILE   jsextension\n           It mines cryptocurrency and reads saved passwords and access keys.\n```\n\n## What it tells you\n\n### A new file arrived that can run commands\n\nIt can run programs, download things, or read your saved passwords. Some run on their own, the moment you install it.\n\n### A file can do more than before\n\nYesterday it only read a file. Today it can run commands. A normal version bump does not trigger a warning.\n\n### A file started connecting somewhere new\n\nSame file, same job, but it now downloads from somewhere it never used before.\n\n## It keeps watching on its own\n\nAnswer two questions and it schedules itself, using whatever your computer already uses to run jobs. It re-runs the same check as often as every 15 minutes. One file, on Mac, Linux, Windows and the BSDs. On Pro it never opens a connection and never holds a password, so it works on a factory floor with no internet.\n\n## Most days it reports nothing.\n\nThat is the point. No report means nothing gained a new power. When it finds a change, it flags the one file and leaves the decision to you.\n\n## Free to run online.\n\nOne line installs it. Run **vigi activate** and Free is yours, on as many machines as\nyou like. It needs the internet to run. It never sends your code, your paths, or your\nfile names. The [privacy policy](/privacy) lists exactly what it sends.\n\n```\ncurl -fsSL https://vigihq.com/install.sh | sh\n```\n\n## Pro free for two years.\n\nEarly adopters get Pro free for two years. No checkout and no card. Share your logo or a one-line quote, and Pro is yours.\n\nThe first teams are running it now. Logos and quotes when they say yes.\n\n## Pricing\n\nTwo plans. Both have all features. Pick online or offline.\n\n### Free\n\n$0/mo\n\nRuns online.\n\n- All features, any number of machines\n- One command to start:\n**vigi activate** - Needs internet to run\n\n[Start free](/activate)\n\n### Pro\n\n$99/mo, per company\n\n$79/mo, billed yearly ($950/yr)\n\nRuns offline.\n\n- All features included\n- One flat price for the whole company\n- Any number of machines, no per-seat cost\n- One signed file installs on all of them\n- Works with no internet\n- Next business day support\n\n[Get Pro](https://buy.stripe.com/bJe6oGgxFaGZ72J1w7aZi04)\n\nEarly adopters get Pro free for two years. [Ask above](#early).\n\n## What it does not do\n\nNo CVE scores, no CWE classes, no AI guesswork. It does not lint your code or catch a logic bug. Code quality is not the job. It watches what each file can do, and tells you when that changes.\n\nIt profiles what you install. It shows what a program can do, so you skip building an SBOM, the list of what is inside your software, and reading it yourself. During development, it shows which of your own files hold the most power. Point your SAST tools and code review at those files first.\n\nIt never blocks anything. It tells you, and you decide. It does not know good from bad, so it flags the change and a person reads the update notes.\n\nIf somebody already owns the whole computer, they own this too. That is what network detection and good security practices guard against. Vigilance works from a version you trust and watches what changes after that.\n\n## FAQ\n\n## Where does it fit in my pipeline?\n\nIt checks the files that reach you, from the package you pull to the code on a machine. You can run it at four points. At each one it does the same thing. It remembers the files from last time. Then it shows what changed this time.\n\n**Dependencies.** Run it when you pull a package. It flags any file the new version added or changed.**Build.** Run it on the build output. It flags a file the build made that nobody wrote.**Release.** Run it before you ship. It compares the new build to the last one you trust.**On the machine.** Run it on the installed files. It catches an install that did something new.\n\nIt reads the files that reach you, source included, and needs no rules. What it does not do is judge your code for logic or quality. That stays a job for your SAST tool and a reviewer.\n\n## Can it look inside packages and archives?\n\nYes. It reads inside deb, rpm and npm packages, and inside xz, zstd, lz4, 7z, MSI, CAB, xar, ISO and squashfs, every reader hand-written with no dependency. A format it cannot open yet becomes a loud finding, never a quiet pass.\n\n## How is this different from antivirus?\n\nAntivirus finds known bad files. Vigilance finds new behavior in a clean-looking update.\n\n## Does it send my files anywhere?\n\nNever your files. Pro opens no connection at all. Free posts a signed report of each file hash and the powers found in it, and never your code, never a path, never a name.\n\n## Does it need the internet?\n\nPro does not. It works fully offline, even air-gapped. Free needs the internet to run.\n\n## What does it run on?\n\nOne file, on Mac, Linux, Windows and the BSDs.\n\n## What happens when it finds something?\n\nIt flags the file and what changed. It never blocks anything. You decide.\n\n## Can it stop a bad update on its own?\n\nNo. It tells you, and you decide. It does not know good from bad.\n\n## Is it open source?\n\nNo, it is a commercial product. You can still check every download on the [Verify](/verify) page.\n\n## What if someone owns the whole machine?\n\nThen they own this too. That is what network detection and good security practices guard against. Start from a version you trust.\n\n## What happens to Pro at renewal time?\n\nA renewing Pro licence keeps running for a few days past its date, while the renewal charge clears. A cancelled one stops on the date. A fresh signed file arrives by email each period.\n\n## See how it complements your current tools.\n\nTwenty-three head-to-head comparisons, and one chart with all of them.\n\n## Talk to us\n\nA question, a pilot, or a bigger fleet? Send a note. It reaches a person.", "url": "https://wpnews.pro/news/vigilance-catch-supply-chain-attacks-without-the-noise-or-the-work", "canonical_source": "https://vigihq.com/", "published_at": "2026-08-25 10:28:24+00:00", "updated_at": "2026-08-25 10:44:56.658859+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools"], "entities": ["Vigilance", "Vigilance HQ", "SolarWinds", "3CX", "XZ Utils", "event-stream", "Codecov", "ua-parser-js"], "alternates": {"html": "https://wpnews.pro/news/vigilance-catch-supply-chain-attacks-without-the-noise-or-the-work", "markdown": "https://wpnews.pro/news/vigilance-catch-supply-chain-attacks-without-the-noise-or-the-work.md", "text": "https://wpnews.pro/news/vigilance-catch-supply-chain-attacks-without-the-noise-or-the-work.txt", "jsonld": "https://wpnews.pro/news/vigilance-catch-supply-chain-attacks-without-the-noise-or-the-work.jsonld"}}