Blocking malicious npm packages before and during installation
Vercel has introduced automated checks to block malicious npm packages during and before dependency installation, aiming to prevent harmful scripts from executing in builds.
Vercel now scans npm packages against a predefined blocklist before and during dependency installation to stop malicious scripts from running. The blocklist targets specific package versions flagged for malware or security flaws, with updates typically applied to new builds within minutes. This ensures risks are identified early in the deployment process, reducing exposure to known threats.
The checks extend to supported lockfiles, including scenarios where dependencies are restored from the build cache. During installation, Vercel actively blocks affected public npm downloads, preventing compromised packages from being installed. Existing dependency and function output checks remain in place before deployment, maintaining layered security measures.
These protections are automatically enabled for all new builds across all plans without requiring manual configuration. If a blocked dependency is detected, Vercel halts the deployment and provides clear error messaging identifying the package and version. The system also attempts to invalidate the affected build cache to prevent reuse of compromised dependencies.
Users are advised to update the problematic dependency to a safe version and refresh the lockfile before redeploying. This process ensures deployments proceed only with verified, secure dependencies, minimizing disruption while maintaining security standards.