# Shai-Halud Supply Chain Campaign — Expanded Impact & Vercel Response

By Steven Van · 2025-09-16

Vercel found 10 customer projects hit by the spreading Shai-Halud npm supply chain attack and shares steps to secure builds.

A supply chain campaign tracked as Shai-Halud has grown beyond its original scope. It started with the Qix compromise of around 18 core npm packages, including **chalk**, **debug**, and **ansi-styles**, then spread to over 40 more packages through a "worm" vector affecting Tinycolor, to the CrowdStrike/crowdstrike-publisher namespace, and to a compromised DuckDB maintainer account publishing versions of the same wallet-drainer malware. No [Vercel](<https://creatorstoolbox.com/tools/vercel>) customer builds were affected in the DuckDB incident.

Vercel identified 10 customer projects whose builds depended, directly or transitively, on the compromised package versions, and notified those customers with project-level guidance. In response, Vercel:

- Blocklisted known compromised versions from the Tinycolor, CrowdStrike, Qix, and DuckDB-affected packages

- Purged build caches for affected projects

- Coordinated safe rebuilds with clean dependencies and pinned safe versions

- Raised platform alerting and detection thresholds for new package publishes matching Shai-Halud indicators

Vercel is also working with npm, open-source maintainers, and ecosystem security partners to track further spread, and is tightening lifecycle/postinstall script policies, lockfile hygiene, registry validation, and internal CI/CD controls. It recommends that users enable pnpm 10.16's **minimumReleaseAge** setting to delay dependency updates, audit direct and transitive dependencies for the affected namespaces, rebuild with pinned versions and clean lockfiles, rotate npm/GitHub/CI/CD tokens used alongside the compromised dependencies, check for unauthorized GitHub workflow files, and limit lifecycle script permissions.

Read the full [announcement](<https://vercel.com/changelog/shai-halud-supply-chain-campaign-expanded-impact-and-vercel-response>), including the incident timeline.

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://vercel.com/changelog/shai-halud-supply-chain-campaign-expanded-impact-and-vercel-response>)

[Read Shai-Halud Supply Chain Campaign — Expanded Impact & Vercel Response on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-shai-halud-supply-chain-campaign-expanded-impact-and-vercel-response>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-shai-halud-supply-chain-campaign-expanded-impact-and-vercel-response