AI Briefing
KOSign in

Vercel blocks malicious npm packages before and during installation

·2026.11.02 09:00

Key point

The protection applies automatically to new builds on all plans with no configuration required, failing deployments if a blocked dependency is detected.

Details

  • Vercel now checks for blocked npm packages before and during dependency installation to prevent malicious install scripts from running.
  • The system uses a blocklist of specific package versions selected for malware or security vulnerabilities, with new rules typically reaching new builds within minutes.
  • Checks occur before installation by scanning supported lockfiles (including cached dependencies) and during installation by blocking affected public npm downloads.
  • If a blocked dependency is detected, Vercel fails the deployment, identifies the package and version in the error, and attempts to invalidate the affected build cache.
  • These protections apply automatically to new builds on all plans with no configuration required.
  • Users must update the dependency to a safe version and update the lockfile to redeploy.
vercelnpmsupply-chain-securitydependency-managementbuild-systems
Read originalShare on Threads

This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.

Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.

Related

Vercel BlogVercel speeds up pnpm installs by reusing dependency verificationVercel BlogVercel MCP adds interactive deployment cards for ChatGPT and MCP Apps clientsPyTorchKRVercel durable-harness supports log-based turn resumption on function failureHacker NewsDHS Orders Removal of DeepSeek Products from U.S. Federal Civilian AgenciesAWS BlogAWS Lambda Web Functions enables standard HTTP servers without adapters; S3 available on Vercel Marketplace