Vercel now checks for blocked npm packages before and during dependency installation in builds, helping prevent malicious install scripts from running. The checks use a blocklist of specific package versions selected for blocking because of malware or security vulnerabilities, with new rules typically reaching new builds within minutes. Before installation, Vercel checks supported lockfiles, including when dependencies are restored from the build cache. During installation, Vercel blocks affected public npm downloads. Existing checks of installed dependencies and function outputs continue before deployment. These protections apply automatically to new builds on all plans, with no configuration required. If a blocked dependency is detected, Vercel fails the deployment, identifies the package and version in the error, and attempts to invalidate the affected build cache. Update the dependency to a safe version and update the lockfile, then redeploy.
AI NEWS JOURNAL
VercelAI NEWS / JOURNAL
Blocking malicious npm packages before and during installation
Vercel now proactively checks for and blocks malicious npm packages before and during dependency installation in builds using a dynamic blocklist, preventing harmful scripts from executing. The system scans supported lockfiles and public npm downloads, automatically failing deployments if a blocked package is detected, identifying the problematic package and version, and attempting to invalidate the build cache. Users must update to a safe dependency version and regenerate the lockfile before redeploying. These security measures apply automatically to all plans without requiring configuration.