--- title: "How I Keep a Compromised Package Update Out of Tigzig, and Why Security Agents Watch the Advisories" slug: supply-chain-keeping-compromised-updates-out-nov2026 date_published: 2026-11-01T14:03:00.000Z original_url: https://www.tigzig.com/post/supply-chain-keeping-compromised-updates-out-nov2026 source: fresh processed_at: 2026-11-01T14:03:00.000Z --- # How I Keep a Compromised Package Update Out of Tigzig, and Why Security Agents Watch the Advisories Many recent supply chain attacks came in through a normal update of a trusted package. Here is what I do on Tigzig to keep a compromised update out. The people behind those packages are fellow builders, and victims too, through a hijacked account. I feel for them. - New versions wait. On all my main apps the build refuses any package version less than 21 days old. Most compromised releases are caught and pulled within that time. - Exact versions only, including the package manager itself, installed from a locked file. - Packages cannot run their own code while installing, apart from a short list I allow. - I check the name, publisher and history of any new package before it goes in, especially one an AI coding tool suggested. - Coolify runs all my backend servers, and it does not update itself. A new version waits two weeks. A fix for a hole that affects me goes in the same day. - I update VS Code and its one extension, Claude Code, by hand. My security agent on watch tells me within the hour if a security fix affects me. ## How I keep track - Scheduled jobs pull in new security advisories, every hour for my coding tools and every few hours for my servers and the packages inside my apps. - AI security agents, running as Claude Code sessions, watch round the clock. They assess each advisory and act on their own within a ladder I set, and tell me after (Act first - inform later). - I get a call on my mobile for anything urgent, like an approval they are stuck on or something they cannot do. The call keeps ringing until I acknowledge it. - The advisories also show on my monitoring dashboard. ## Still pending Many of these meant time and token consuming migrations. A few older single-page tools still load libraries from public CDNs, and moving them is on my list. I also take a new release of some browser-based tool straight away now and then, when I need it. And the pending list .. it never ends ... ## Still learning I am not a security expert. I come from data science, and most of this is new to me...still learning...mostly the hard way. ## Details are in my security checklist, section 11 **For you** [tigzig.com/security](https://www.tigzig.com/security) **For your AI** "Go to tigzig.com security section. Open live page directly. Tell me how it handles supply chain risk" ## Learned the hard way I learned most of this the hard way. I run open data apps with no login and no API key, and some of them give SQL access to live databases. Anyone can reach them, so a slip shows up fast. I made all the mistakes: an API key left exposed, no rate limits so a server ran down under too many requests, a security update not applied, a default setting never changed, and no monitoring or control over what came in and what went out and many more ... This year it has got much worse. What I see now is very different from what I saw in January, and it is a game that never ends. My first read every morning is now the overnight update from my security sessions and my security dashboard. The business news and everything else comes after. --- Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar Source: https://www.tigzig.com/post/supply-chain-keeping-compromised-updates-out-nov2026 Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar. License: https://www.tigzig.com/terms ## Related Tools: [QDesk - Quant Report Desk](https://www.tigzig.com/qdesk), [TREMOR - Macro Stress Signals](https://www.tigzig.com/tremor), [DATS-4 Database AI Suite](https://www.tigzig.com/analyzer) Explore: [Security checklist](https://www.tigzig.com/security), [API and MCP catalog](https://www.tigzig.com/apis), [What is new](https://www.tigzig.com/changelog) More posts: [How I Spot a Fake Crawler: Check the Address, Not the Name](https://www.tigzig.com/post/fake-crawler-check-address-not-name-oct2026), [2026 Infra Guide for AI Tool Builders - Part 3: The 18 Common Security Mistakes and How to Fix Them](https://www.tigzig.com/post/2026-infra-guide-part-3-security-mistakes), [Security Checklist for Web Apps - 71 Items](https://www.tigzig.com/post/security-checklist-web-apps-71-items), [2026 Infra Guide for AI Tool Builders - Part 5: Perimeter Security on Cloudflare (Free Plan)](https://www.tigzig.com/post/perimeter-security-cloudflare-free-plan), [My Public MCP Server Got Hammered - Security Lessons from a Bot Attack](https://www.tigzig.com/post/mcp-server-bot-attack-security-lessons)