Vercel adds pre-install and during-install checks for blocked npm package versions
Vercel now checks for blocked npm package versions before and during dependency installation in builds, to help prevent malicious install scripts from running. The blocklist contains specific package versions selected for malware or security vulnerabilities, and new rules typically reach new builds within minutes.
Why it matters
Builds that install a compromised npm package version can run malicious install scripts before deployment checks complete. The new checks fail deployments that contain blocked dependencies earlier in the build process, and they apply to new builds on all plans without configuration.
Who should care
Developers and teams deploying Next.js or other npm-based projects on Vercel, agencies managing client sites, and ecommerce brands running custom storefront code.
What you can do
Update any flagged dependency to a safe version, update the lockfile, and redeploy, since a blocked dependency fails the deployment and reports the package and version in the error.