Shai-Hulud 2.0 Supply Chain Compromise
By Steven Van ·
Vercel found no impact to its own systems but is contacting a limited set of customers whose builds referenced compromised npm packages.
A malicious actor compromised multiple npm packages from various web services through account takeover, adding a stealthy loader to their package.json files. The loader locates the Bun runtime, installs it silently, then runs a malicious script.
Vercel says no Vercel-managed systems or internal build processes were affected. As a precaution, it reset the build cache for projects that pulled in any of the vulnerable packages while it investigates whether any loaders actually ran. Preliminary analysis found a limited set of customer builds referencing the compromised packages, and Vercel is contacting those customers directly with mitigation steps. Read the full announcement for updates.