# Vercel — Critical npm supply chain attack response – September 8, 2025

- Company: Vercel (vercel.com)
- Announced: 2025-09-08T13:00:00+00:00
- Category: not stated
- Coverage: not counted
- Announcement: no
- Group: routine
- Source: https://vercel.com/blog/critical-npm-supply-chain-attack-response-september-8-2025
- Record: https://forck.live/items/20827-critical-npm-supply-chain-attack-response-september-8-2025
- Subject: v0 / AI SDK / AI Gateway

Vercel reported a supply chain attack on September 8, 2025, that compromised 18 popular npm packages including chalk, debug, and ansi-styles. The injected code intercepted cryptocurrency transactions in browsers. Vercel identified 70 teams with 76 affected projects, purged build caches, and notified customers; no Vercel customers were impacted by a subsequent DuckDB-related incident.

## Evidence

Verbatim from https://vercel.com/blog/critical-npm-supply-chain-attack-response-september-8-2025:

> On September 8, 2025, a supply chain attack compromised 18 popular npm packages including chalk , debug , and ansi-styles . The injected code was designed to intercept cryptocurrency transactions in browsers.

---

Record: https://forck.live/items/20827-critical-npm-supply-chain-attack-response-september-8-2025
Catalogue: https://forck.live/llms.txt
Current issue: https://forck.live/feed.md