Vercel Blocks Malicious Npm Packages During Builds.

Vercel’s malicious npm package blocking now checks dependencies before and during installation. A flagged package can fail the build before its install script runs or the deployment reaches production.

According to the Vercel changelog, the checks use a blocklist of specific package versions associated with malware or security vulnerabilities. New blocking rules typically reach new builds within minutes.

Before installation starts, Vercel checks supported lockfiles for blocked package versions. This also happens when dependencies are restored from the build cache, so a cached dependency does not bypass the check.

During installation, Vercel blocks affected downloads from the public npm registry. Its existing checks of installed dependencies and function outputs still run before deployment.

If Vercel detects a blocked dependency, it fails the deployment and shows the package name and version in the error. It also attempts to invalidate the affected build cache. The fix is to update that dependency to a safe version, update the lockfile and redeploy.

The protection applies automatically to new builds on every Vercel plan. Teams do not need to switch it on or add configuration to their projects.

Vercel already checked installed dependencies and function outputs before deployment. The new checks move part of that protection earlier, covering the point before packages are installed and the period while public npm packages are being downloaded.

That timing is useful because npm packages can run scripts as part of installation. Blocking a known malicious or vulnerable version before or during that process helps prevent its install script from running inside the build environment.

The blocklist works at package-version level rather than blocking every release of a package. When a deployment fails, the error identifies the exact version involved, giving the builder a specific dependency to replace.

What is Vercel’s malicious npm package blocking? It is an automatic build protection that checks supported lockfiles before installation and blocks affected public npm downloads during installation. It uses a blocklist of specific package versions associated with malware or security vulnerabilities.

Which Vercel plans include malicious npm package blocking? The checks apply to new builds on all plans. No configuration is required.

What happens when Vercel finds a blocked npm package? Vercel fails the deployment and identifies the package and version in the build error. It attempts to invalidate the affected build cache; builders must update the dependency and lockfile before redeploying.