Vercel Security Incident Update: npm Package Not Compromised, New Environment Variables Defaulted to "Sensitive"

According to Dongcha Beating monitoring, on the morning of April 21st, the official Vercel account announced that after a joint investigation with GitHub, Microsoft, npm, and Socket, any package published by Vercel on npm had not been tampered with, and the supply chain remains "secure." Vercel maintains open-source libraries such as Next.js, Turbopack, and SWR on npm, with a total monthly download volume in the billions. If an attacker were to poison them using an employee account, the impact would far exceed Vercel's own customers. This verification process eliminated the largest associated risk in this incident.

On the same day, the official security announcement was updated with three additional details. The scope of affected parties was narrowed down to the field level for the first time. The announcement stated that the leaked information was the part of the customer environment variables that were not marked as "sensitive," which were stored in plain text after being decrypted in the background. Vercel is still investigating whether more data was taken. A new recommendation was added for customers: "Deleting a Vercel project or account itself does not eliminate the risk." It is necessary to first rotate all non-sensitive keys and then consider deletion, as the credentials obtained by the attacker can still directly access the production system.

On the product side, default settings were changed. Newly created environment variables now default to "sensitive" (sensitive: on). For older accounts, newly added variables were previously of the normal type by default, requiring manual selection to enable sensitivity. This was the direct entry point for the attacker to read plaintext variables in this incident. The dashboard has simultaneously launched a more detailed activity log interface and team-level environment variable management. "Enable two-factor authentication" has been pushed to the forefront of all security recommendations.