Vercel now blocks malicious npm packages during every build
Builds on every plan automatically fail and try to invalidate their cache if a dependency matches a blocklist of malware or vulnerable package versions, no setup required.
Vercel now checks every build for blocked npm packages before and during dependency installation, the company said on 2 November. The checks run against a blocklist of specific package versions flagged for malware or security vulnerabilities, covering lockfiles even when dependencies are restored from the build cache, and blocking the download itself if a flagged package tries to install from the public registry.
The protection applies automatically to new builds on every plan, with no configuration required, and sits alongside Vercel’s existing checks of installed dependencies and function outputs. New blocklist entries reach builds within minutes. If a build hits a blocked dependency, Vercel fails the deployment, names the package and version in the error, and attempts to invalidate the affected build cache so a fixed version gets a clean install.
Why it matters: this closes a real window. Several npm supply-chain compromises this year got into production because a bad version sat in a lockfile or cache for hours before anyone noticed. Automatic, no-config blocking at build time catches that without anyone needing to re-audit dependencies by hand.
The caveat: it only catches what Vercel has already blocklisted. A newly published malicious package that hasn’t been flagged yet will still install.