Vigilance vs SafeDep
SafeDep. Scans your dependencies and flags a package its feed or analysis calls malicious, in CI and before install. Its open tool is vet.
Vigilance. Runs on your own machine and says what changed since it last looked.
Vigilance as a SafeDep alternative
Vigilance is a SafeDep alternative that runs on your own machine. It names the one file that gained a new power, before you trust an update. Below, a plain table sets the two side by side.
Side by side
| Question | SafeDep | Vigilance |
|---|---|---|
| Checks a public npm, PyPI or crates.io package | Yes | Yes, once it is on disk |
| Blocks a bad package in CI or before install | Yes | No |
| Needs a threat feed or cloud lookup to decide | Yes | No |
| Covers software that did not come from a public registry | No | Yes |
| Covers a vendor file drop, an installer or a firmware image | No | Yes |
| Works with no internet at all | No | Pro |
| Runs on the machine after install, not just in CI | No | Yes |
Which one do you need?
SafeDep guards the packages you pull from public registries, inside your pipeline. Vigilance guards everything else on the machine, and needs no feed to decide.
A look-alike crate, as an example
A dependency posing as the real arrayref crate carried a build script that ran
at build time. It reached a server, ran a downloaded program, and wrote files, with the
address hidden in base64. SafeDep names it once its feed or analysis marks it bad.
Vigilance compares the crate against the version you trust and flags the file that can
suddenly reach the network and run a program, before anyone reports it.
Known risk versus new risk
A package a feed or analysis already calls bad. SafeDep and most tools work here.
A file that gained a power it never had, that no report covers yet. Vigilance works here.
Common questions
Is Vigilance a SafeDep alternative?
Yes, for one job. Vigilance names the file that gained a new power, on your own machine. Many teams run it next to SafeDep.
What does Vigilance do that SafeDep does not?
Vigilance can look inside a package, installer or container.
What does SafeDep do that Vigilance does not?
SafeDep finds known bugs that already have a name and a number. Vigilance does not.
Does Vigilance need the internet or a cloud account?
The Free plan runs online. Pro runs fully offline, with no cloud account.
Try it on your own software.
Show it the version you run today and the one you are about to install.
Talk to us
A question, a pilot, or a bigger fleet? Send a note. It reaches a person.