Blog
The Vigilance blog
Supply chain attacks, what changed, and how to read an update before you trust it.
Bounty Farming: Good Intent Still Runs on Your Machine
A PyPI package called itself a proof of concept and sent the name and IP address of each computer that installed it to a public webhook. We call this pattern bounty farming. Intent does not change what the code does.
AdvisoryVIGI-002-2026: pystr-codec runs a token-stealing worm at every Python start
pystr-codec 0.1.1 adds a startup file that downloads Bun and runs a hidden worm. The worm steals developer tokens and republishes itself.
AnalysisThe Code That Runs Before You Open Anything
The newest Python attack does not wait for you to run anything. A file that arrives with a package runs at startup, on every process, forever. We caught one live this week.
NewsWe Joined Anthropic's Cyber Verification Program
Anthropic approved Vigilance into its Cyber Verification Program. Anthropic no longer blocks our dual-use security work on Claude by default. Banned uses stay blocked.
AdvisoryVIGI-001-2026: @apexacc/cli disables Windows security controls and installs a backdoor
@apexacc/cli 1.5.122 turns off Windows Defender and Smart App Control. Then it runs commands from a remote server.
No posts match that search.