Vercel Security Incident Update: npm packages were not compromised; new environment variables are now defaulted to "Sensitive"

ME News Report, April 21 (UTC+8). According to Beating Monitoring, Vercel’s official account announced on the morning of April 21 that, after a joint investigation with GitHub, Microsoft, npm, and Socket, no packages published by Vercel on npm had been tampered with, and the supply chain “remains secure.” Vercel maintains open-source libraries on npm such as Next.js, Turbopack, and SWR, with total monthly downloads in the hundreds of millions. If attackers poisoned the software supply chain by using employee accounts, the impact would be far greater than that on Vercel’s own customers. This review ruled out the largest associated risk in the incident.

On the same day, the official security announcement was updated with three additional details. The scope of the impact was first clarified down to the field level. The announcement states that what was leaked was the portion of customer environment variables that had not been marked as “sensitive,” which are decrypted in the backend and stored in plaintext. Whether more data was taken away remains under investigation by Vercel. The customer recommendation was also expanded to include: “Deleting the Vercel project or the account itself cannot eliminate the risk.” First, all keys that have not been marked as sensitive must be rotated; only then should you consider deleting actions, because the credentials obtained by attackers can still directly connect to production systems.

On the product side, the default settings have been changed. Newly created environment variables now default to “sensitive” (sensitive: on). For old accounts, variables added in the past default to the normal type, and users must manually check the option to enable sensitive status. This is the direct entry point that allowed the attackers to read the plaintext variables. The Dashboard also rolled out a denser activity log interface and team-level environment variable management; among all security recommendations, “enable two-factor authentication” has been moved to the top priority.

(Source: BlockBeats)