From the source
Vercel reported a supply chain attack on September 8, 2025, that compromised 18 popular npm packages including chalk, debug, and ansi-styles.
The injected code intercepted cryptocurrency transactions in browsers.
Vercel identified 70 teams with 76 affected projects, purged build caches, and notified customers; no Vercel customers were impacted by a subsequent DuckDB-related incident.
