Software supply chain risk
The Cost of a
Compromised Update
A compromised update can cost money for years after a company removes it. SolarWinds reported insurance payments for its 2020 cyberattack four years later.
$50m
Insurance payments to SolarWinds in 2022 and 2023, in US dollars.
Payments recorded in the annual report
SolarWinds reported these insurance payments for costs from its 2020 cyberattack:
- 2022
- $30.202 million
- 2023
- $19.798 million
The $50 million covers payments to SolarWinds alone. It does not include losses at its customers. It is not the total cost of the attack.
Source: SolarWinds 2024 annual report, Note 15, “Cyber Incident.”
See what an update can do before you deploy it.
Vigilance compares two versions of the software. It shows each file that gained a capability, such as running a command or reading a saved password.
Review those changes before you install the update on customer systems or company machines.
vigi diff --old ./current --new ./updateRun the comparison against the version you trust and the new release. Read the findings before you approve the update.
A new capability needs review. It does not prove that an update is malicious. Vigilance reports what it finds. Your team decides what to install.
Read the comparison guide →From the npm investigation
An update that added encoded PowerShell
Version 1.5.122 of @apexacc/cli added an encoded PowerShell command. That command asks for administrator rights.
The advisory records the change and the evidence behind it.
Read the npm investigation →Keep the evidence for your risk review.
Save the comparison report with your deployment record. It shows what Vigilance found in the versions you checked.
Use that record when you explain your update review process to customers, auditors, or insurers.
The SolarWinds payments are a documented cost. They do not show losses that Vigilance prevented, and they do not promise an insurance discount.
Check your next update.
Compare two versions in the browser, or download Vigilance to scan your own files.