The Vercel security and compute teams have conducted an investigation into the malicious takeover of the 𝚊𝚡𝚒𝚘𝚜@𝟷.𝟷𝟺.𝟷 npm package. • We’ve blocked outgoing access from our build infrastructure to the Command & Control hostname 𝚜𝚏𝚛𝚌𝚕𝚊𝚔.𝚌𝚘𝚖. • The malicious version of the package has been blocked and unpublished from npm. • Vercel’s own infrastructure and applications have been unaffected. • We recommend checking your supply chain for exposure. For more information, read the full advisory ↓