# Shai-Hulud 2.0 Supply Chain Compromise

By Steven Van · 2025-11-24

Vercel found no impact to its own systems but is contacting a limited set of customers whose builds referenced compromised npm packages.

A malicious actor compromised multiple npm packages from various web services through account takeover, adding a stealthy loader to their package.json files. The loader locates the Bun runtime, installs it silently, then runs a malicious script.

[Vercel](<https://creatorstoolbox.com/tools/vercel>) says no Vercel-managed systems or internal build processes were affected. As a precaution, it reset the build cache for projects that pulled in any of the vulnerable packages while it investigates whether any loaders actually ran. Preliminary analysis found a limited set of customer builds referencing the compromised packages, and Vercel is contacting those customers directly with mitigation steps. Read the [full announcement](<https://vercel.com/changelog/shai-hulud-2-0-supply-chain-compromise>) for updates.

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://vercel.com/changelog/shai-hulud-2-0-supply-chain-compromise>)

[Read Shai-Hulud 2.0 Supply Chain Compromise on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-shai-hulud-2-0-supply-chain-compromise>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-shai-hulud-2-0-supply-chain-compromise