Vigilance – Catch supply chain attacks without the noise or the work

Vigilance, a new software supply chain security tool from Vigilance HQ, detects poisoned updates by flagging files that gain new capabilities, without using AI, CVE databases, or dependencies, and works offline on Pro. The tool, which requires no setup beyond pointing it at a folder, would have caught major attacks including SolarWinds 2020 (18,000 networks), 3CX 2023 (600,000 companies), XZ Utils 2024, event-stream 2018, Codecov 2021, and ua-parser-js 2021.

Software supply chain security Catch supply chain attacks without the noise. A poisoned update looks normal. Vigilance flags the one file that gained a new power, before you install it. No AI | No CVE Database | No Dependencies | Offline on Pro curl -fsSL https://vigihq.com/install.sh | sh read the installer before you pipe it /verify installer 0 installations Point it at a folder. That is it. The first run learns the folder. Every run after shows what changed. Nothing to set up. Where attacks hide, and where we watch A bad change has to travel. It can be planted in the source, slip in through a library, ride your build, become a release, and land on a machine. It can be a poisoned library like event-stream, a build like SolarWinds, or a signed update like 3CX. Put Vigilance anywhere along the chain and it catches the change before it runs, even on a box with no network, on Pro. Compatible on any machine We watch the whole chain, on any machine. We do not lint your code or catch logic bugs. Code quality is not our job. We look for one thing: a file that gains a power it never had. So we catch the change that can do something new: a poisoned source file, a dependency, a build step, an install hook, a package or a binary. Start from a version you trust. What you would have seen Each of these updates was signed and real. The other files looked normal. This is what Vigilance prints when you compare the version you trust against the poisoned one. Open a row to read it. SolarWinds 2020 A signed update. 18,000 networks installed it. bash $ vigi diff --old orion-2019.4.5200-9083 --new orion-2020.2.1 vigi Files Scanned: 18,342 1 Added HEADS UP 1 file can now do things the old version could not. CHANGED Orion.Core.BusinessLayer.dll It now runs other programs. It did not before. It now talks to avsvmcloud.com. It did not before. The change is in its compiled code, not only its data. 3CX 2023 A signed installer. It shipped to 600,000 companies. bash $ vigi diff --old 3cxdesktopapp-18.12.407 --new 3cxdesktopapp-18.12.416 vigi Files Scanned: 1,204 HEADS UP 2 files can now do things the old version could not. CHANGED ffmpeg.dll It now scrambles or unscrambles data. It did not before. The change is in its compiled code, not only its data. CHANGED d3dcompiler 47.dll It now downloads something and runs it straight away. It did not before. XZ Utils 2024 A backdoor headed for every major Linux. bash $ vigi diff --old xz-5.4.6 --new xz-5.6.1 vigi Files Scanned: 414 3 Added HEADS UP 1 file can now do things the old version could not. 2 more changed and can do nothing new. CHANGED liblzma.so.5.6.1 It now writes into another running program. It did not before. The change is in its compiled code, not only its data. event-stream 2018 A package millions of apps pulled in each week. bash $ vigi diff --old event-stream-3.3.5 --new event-stream-3.3.6 vigi Files Scanned: 12 2 Added HEADS UP 1 file can now do things the old version could not. NEW FILE node modules/flatmap-stream/index.min.js It handles crypto keys and scrambles or unscrambles data. Codecov 2021 One line changed. Thousands of pipelines ran it. bash $ vigi diff --old codecov-bash.old --new codecov-bash.new vigi Files Scanned: 1 HEADS UP 1 file can now do things the old version could not. CHANGED codecov It now reads saved passwords and access keys. It did not before. It now talks to 104.248.94.23. It did not before. ua-parser-js 2021 Downloaded millions of times a week. bash $ vigi diff --old ua-parser-js-0.7.28 --new ua-parser-js-0.7.29 vigi Files Scanned: 28 2 Added HEADS UP 2 files can now do things the old version could not. NEW FILE preinstall.sh Runs during an install or a build. It downloads something and runs it straight away. NEW FILE jsextension It mines cryptocurrency and reads saved passwords and access keys. What it tells you A new file arrived that can run commands It can run programs, download things, or read your saved passwords. Some run on their own, the moment you install it. A file can do more than before Yesterday it only read a file. Today it can run commands. A normal version bump does not trigger a warning. A file started connecting somewhere new Same file, same job, but it now downloads from somewhere it never used before. It keeps watching on its own Answer two questions and it schedules itself, using whatever your computer already uses to run jobs. It re-runs the same check as often as every 15 minutes. One file, on Mac, Linux, Windows and the BSDs. On Pro it never opens a connection and never holds a password, so it works on a factory floor with no internet. Most days it reports nothing. That is the point. No report means nothing gained a new power. When it finds a change, it flags the one file and leaves the decision to you. Free to run online. One line installs it. Run vigi activate and Free is yours, on as many machines as you like. It needs the internet to run. It never sends your code, your paths, or your file names. The privacy policy /privacy lists exactly what it sends. curl -fsSL https://vigihq.com/install.sh | sh Pro free for two years. Early adopters get Pro free for two years. No checkout and no card. Share your logo or a one-line quote, and Pro is yours. The first teams are running it now. Logos and quotes when they say yes. Pricing Two plans. Both have all features. Pick online or offline. Free $0/mo Runs online. - All features, any number of machines - One command to start: vigi activate - Needs internet to run Start free /activate Pro $99/mo, per company $79/mo, billed yearly $950/yr Runs offline. - All features included - One flat price for the whole company - Any number of machines, no per-seat cost - One signed file installs on all of them - Works with no internet - Next business day support Get Pro https://buy.stripe.com/bJe6oGgxFaGZ72J1w7aZi04 Early adopters get Pro free for two years. Ask above early . What it does not do No CVE scores, no CWE classes, no AI guesswork. It does not lint your code or catch a logic bug. Code quality is not the job. It watches what each file can do, and tells you when that changes. It profiles what you install. It shows what a program can do, so you skip building an SBOM, the list of what is inside your software, and reading it yourself. During development, it shows which of your own files hold the most power. Point your SAST tools and code review at those files first. It never blocks anything. It tells you, and you decide. It does not know good from bad, so it flags the change and a person reads the update notes. If somebody already owns the whole computer, they own this too. That is what network detection and good security practices guard against. Vigilance works from a version you trust and watches what changes after that. FAQ Where does it fit in my pipeline? It checks the files that reach you, from the package you pull to the code on a machine. You can run it at four points. At each one it does the same thing. It remembers the files from last time. Then it shows what changed this time. Dependencies. Run it when you pull a package. It flags any file the new version added or changed. Build. Run it on the build output. It flags a file the build made that nobody wrote. Release. Run it before you ship. It compares the new build to the last one you trust. On the machine. Run it on the installed files. It catches an install that did something new. It reads the files that reach you, source included, and needs no rules. What it does not do is judge your code for logic or quality. That stays a job for your SAST tool and a reviewer. Can it look inside packages and archives? Yes. It reads inside deb, rpm and npm packages, and inside xz, zstd, lz4, 7z, MSI, CAB, xar, ISO and squashfs, every reader hand-written with no dependency. A format it cannot open yet becomes a loud finding, never a quiet pass. How is this different from antivirus? Antivirus finds known bad files. Vigilance finds new behavior in a clean-looking update. Does it send my files anywhere? Never your files. Pro opens no connection at all. Free posts a signed report of each file hash and the powers found in it, and never your code, never a path, never a name. Does it need the internet? Pro does not. It works fully offline, even air-gapped. Free needs the internet to run. What does it run on? One file, on Mac, Linux, Windows and the BSDs. What happens when it finds something? It flags the file and what changed. It never blocks anything. You decide. Can it stop a bad update on its own? No. It tells you, and you decide. It does not know good from bad. Is it open source? No, it is a commercial product. You can still check every download on the Verify /verify page. What if someone owns the whole machine? Then they own this too. That is what network detection and good security practices guard against. Start from a version you trust. What happens to Pro at renewal time? A renewing Pro licence keeps running for a few days past its date, while the renewal charge clears. A cancelled one stops on the date. A fresh signed file arrives by email each period. See how it complements your current tools. Twenty-three head-to-head comparisons, and one chart with all of them. Talk to us A question, a pilot, or a bigger fleet? Send a note. It reaches a person.