Vercel blocks known malicious npm versions before install scripts run

Vercel now checks supported lockfiles before installing dependencies and blocks affected public npm downloads during installation. The checks target a blocklist of specific package versions, including when dependencies come from a build cache. They apply automatically to new builds on all plans, aiming to stop known malicious install scripts before they execute.

Vercel · Andrew Healey · Nov 2, 2026

Why it matters

Checking dependencies only after installation can leave the build exposed to install-time code.

More context

When a blocked version is found, Vercel fails the deployment, names the dependency and attempts to invalidate the affected cache. For an affected project, update to a safe dependency version, refresh the lockfile and redeploy; no configuration is required to enable the protection.

Keep in mind

This is a released blocklist-based control, not proof that every malicious package is detected. Its scope is Vercel builds and supported dependency paths.

Original read