Vercel deploy failed because of an npm package? Vercel now blocks malicious versions
Ship ItChecked against the official source
Source checked 4 Nov 2026 · Published 4 Nov 2026 · Last reviewed 4 Nov 2026 · By Ctrl+Z Therapy (how we test)
The short answer
Vercel's changelog of November 2, 2026: Vercel now checks for blocked npm packages before and during dependency installation in builds. The blocklist holds specific package versions selected for blocking because of malware or security vulnerabilities. If a blocked dependency is detected, Vercel fails the deployment and identifies the package and version in the error. It applies automatically to new builds on all plans.
What to do
- Read the failed deployment's error for the blocked package and version.
- Update that dependency to a safe version and update the lockfile.
- Redeploy.
Good to know
- Before installation, Vercel checks supported lockfiles, including when dependencies are restored from the build cache. During installation, it blocks affected public npm downloads.
- New rules typically reach new builds within minutes. Vercel also attempts to invalidate the affected build cache.
Source
Checked on 4 Nov 2026. Prices, limits and settings change, so check the source before you rely on them.