Critical npm supply chain attack response – September 8, 2025
By Steven Van ·
A phishing attack compromised 18 npm packages including chalk and debug, affecting 76 Vercel projects before caches were purged.
A phishing email sent to npm maintainers led to a supply chain attack on September 8, 2025. Attackers compromised 18 popular npm packages, including chalk, debug, and ansi-styles, injecting code that intercepted cryptocurrency and web3 wallet transactions in browsers and redirected payments to attacker-controlled addresses.
Vercel's security and engineering teams identified 70 teams with builds containing the compromised package versions across 76 unique projects. Incident response was activated at 17:39 UTC, and build caches for all 76 affected projects were purged by 22:19 UTC to stop malicious code from being served. Affected customers were notified with project lists requiring rebuilds.
On September 9, the same campaign compromised DuckDB-related packages after the duckdb_admin npm account was breached, using the same wallet-drainer malware. No Vercel customers were affected by the DuckDB incident.
Vercel's recommendations for affected customers include rebuilding listed projects, reviewing dependency update practices, and considering package version pinning. For all customers, it suggests running npm audit, adding dependency scanning to CI/CD pipelines, using npm ci with lockfiles in production builds, and enabling npm package provenance where available. Read the full incident report.
