Critical npm supply chain attack response – September 8, 2025

This post details Vercel's response to a critical npm supply chain attack on September 8, 2025, involving compromised packages like `chalk` and `debug`. Vercel's security and engineering teams identified affected projects, purged build caches to prevent serving malicious code, and notified customers. The attack originated from a phishing campaign targeting npm maintainers. Recommendations for customers include rebuilding projects, reviewing dependency practices, and implementing package version pinning. For all customers, it advises using `npm audit`, implementing dependency scanning, and considering `npm ci`. Vercel is strengthening its posture with enhanced monitoring and rapid cache invalidation.