After a joint investigation with GitHub, Microsoft, npm, and Socket, Vercel says none of its npm packages were compromised. The company maintains popular open-source libraries like Next.js, Turbopack, and SWR on npm, which collectively see hundreds of millions of monthly downloads. Had attackers used a compromised employee account to poison these packages, the fallout would have extended far beyond Vercel's own customer base. This audit eliminates what could have been the incident's most significant collateral damage.
https://twitter.com/vercel/status/2046400830300172625
Security bulletin updates reveal scope
On the same day, Vercel updated its official security bulletin with three key details. For the first time, the affected scope has been clarified down to the field level. According to the bulletin, the leaked data consisted of customer environment variables that weren't marked as "sensitive"—these were stored in plaintext after being decrypted in the backend. Whether additional data was exfiltrated remains under investigation.
A new warning has been added for customers: "Deleting your Vercel project or account itself does not eliminate the risk." The company advises rotating all non-sensitive keys first before considering deletion, since credentials obtained by attackers could still provide direct access to production systems.
Product changes address the vulnerability
On the product side, Vercel has changed a critical default setting. New environment variables now default to "sensitive" (sensitive: on). Previously, for existing accounts, newly added variables defaulted to regular types, requiring manual selection to enable sensitive marking. This was the exact entry point attackers used to read plaintext variables.
The dashboard has simultaneously rolled out a more detailed activity log interface and team-level environment variable management. Among all security recommendations, "Enable two-factor authentication" has been pushed to the top of the list.