Blocking malicious npm packages before and during installation

Vercel now checks for blocked npm packages before and during dependency installation in builds, helping prevent malicious install scripts from running.

The checks use a blocklist of specific package versions selected for blocking because of malware or security vulnerabilities, with new rules typically reaching new builds within minutes.

• Before installation, Vercel checks supported lockfiles, including when dependencies are restored from the build cache.
• During installation, Vercel blocks affected public npm downloads.

Existing checks of installed dependencies and function outputs continue before deployment.

These protections apply automatically to new builds on all plans, with no configuration required.

If a blocked dependency is detected, Vercel fails the deployment, identifies the package and version in the error, and attempts to invalidate the affected build cache. Update the dependency to a safe version and update the lockfile, then redeploy.