Press
Press Kit
Facts, dates, a bio and logos for reporters. You can use all of it without asking. For anything else, write to press@vigihq.com.
Fact sheet
- ProductVigilance
- What it doesVigilance checks the packages that AI tools and staff install on each computer, and finds the file that gained a new power.
- CompanyModul4r Solutions
- Based inEdmonton, Alberta, Canada
- Websitevigihq.com
- Press contactWrite to press@vigihq.com
The @apexacc/cli catch
- 17 Sep 2026Version 1.5.122 of @apexacc/cli goes live on npm at 08:27 UTC. It turns off two Windows security features and installs a backdoor.
- 17 Sep 2026Vigilance flags it at 19:39 UTC. No security database has it. 0 of 63 virus scanners flag its Mac helper file that day.
- 12 Oct 2026Elastic Security Labs publishes report REF8801, 25 days after Vigilance.
Read the full timeline in advisory VIGI-001-2026. Our second advisory, VIGI-002-2026, covers a PyPI worm that Vigilance flagged 12 minutes after upload.
Marcello Delcaro
Short bio. Marcello Delcaro leads the research at Vigilance. He spent six years in software supply chain security at aDolus Technologies and Exiger.
Long bio. Marcello Delcaro leads the research at Vigilance. His supply chain security work began in 2020 at aDolus Technologies, as SolarWinds broke. Exiger acquired aDolus in 2024. That work took apart major supply chain attacks, from 3CX to the XZ backdoor. It included work on a binary analysis engine that Fortune 500 companies and critical infrastructure operators used. He taught at Vancouver Island University, where new IT professionals trained.
Logos
- Light backgroundSVG · PNG
- Dark backgroundSVG · PNG
- Logo with namePNG on black
The left stroke of the mark is always lime. Do not change its colours or its shape.
Questions about a story?
Write to press@vigihq.com.