How I Keep a Compromised Package Update Out of Tigzig, and Why Security Agents Watch the Advisories
Published: November 1, 2026
Many recent supply chain attacks came in through a normal update of a trusted package. Here is what I do on Tigzig to keep a compromised update out.
The people behind those packages are fellow builders, and victims too, through a hijacked account. I feel for them.
New versions wait. On all my main apps the build refuses any package version less than 21 days old. Most compromised releases are caught and pulled within that time.
Exact versions only, including the package manager itself, installed from a locked file.
Packages cannot run their own code while installing, apart from a short list I allow.
I check the name, publisher and history of any new package before it goes in, especially one an AI coding tool suggested.
Coolify runs all my backend servers, and it does not update itself. A new version waits two weeks. A fix for a hole that affects me goes in the same day.
I update VS Code and its one extension, Claude Code, by hand. My security agent on watch tells me within the hour if a security fix affects me.
How I keep track
Scheduled jobs pull in new security advisories, every hour for my coding tools and every few hours for my servers and the packages inside my apps.
AI security agents, running as Claude Code sessions, watch round the clock. They assess each advisory and act on their own within a ladder I set, and tell me after (Act first - inform later).
I get a call on my mobile for anything urgent, like an approval they are stuck on or something they cannot do. The call keeps ringing until I acknowledge it.
The advisories also show on my monitoring dashboard.
Still pending
Many of these meant time and token consuming migrations. A few older single-page tools still load libraries from public CDNs, and moving them is on my list. I also take a new release of some browser-based tool straight away now and then, when I need it.
And the pending list .. it never ends ...
Still learning
I am not a security expert. I come from data science, and most of this is new to me...still learning...mostly the hard way.
Details are in my security checklist, section 11
For you
For your AI
"Go to tigzig.com security section. Open live page directly. Tell me how it handles supply chain risk"
Learned the hard way
I learned most of this the hard way. I run open data apps with no login and no API key, and some of them give SQL access to live databases. Anyone can reach them, so a slip shows up fast.
I made all the mistakes: an API key left exposed, no rate limits so a server ran down under too many requests, a security update not applied, a default setting never changed, and no monitoring or control over what came in and what went out and many more ...
This year it has got much worse. What I see now is very different from what I saw in January, and it is a game that never ends.
My first read every morning is now the overnight update from my security sessions and my security dashboard. The business news and everything else comes after.
Working on something similar? How I work covers the rates, the availability and what I take on.