Shai-Hulud 2.0 Supply Chain Compromise
Multiple npm packages were compromised through account takeover, with a malicious loader added to package.json that targets the Bun runtime. Vercel's own systems were unaffected, but a limited set of customer builds were identified with vulnerable packages; affected customers are being notified with mitigation steps.
Multiple npm packages from various web services through account takeover/developer compromise. A malicious actor was able to add a stealthy loader to the package.json file that locates the Bun runtime, silently installs, then executes a malicious script.were compromised
Our investigation has shown that no Vercel environment was impacted and we are notifying a small set of customers with affected builds.
Vercel has taken immediate steps to address this for our customers. As an initial step, we reset the cache for projects that pulled in any of the vulnerable packages while we continue to investigate whether any loaders successfully ran.
We will continue to issue updates throughout our investigation.
Impact to Vercel Customers
As of this publication, or internal build processes have been impacted.no Vercel-managed systems
identified referencing the compromised packages.Preliminary analysisa limited set of Vercel customer builds
Impacted customers are being contacted directly with detailed mitigation steps.
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.