Vercel has confirmed that its npm packages remain secure following a recent security incident. After a joint investigation with GitHub, Microsoft, npmjs, and SocketSecurity, Vercel stated that there is no evidence of tampering with its software supply chain. The company reassured users that its npm packages were not compromised. The incident, reported on April 19, involved unauthorized access to Vercel's internal systems. Attackers exploited Google Workspace OAuth credentials from a third-party AI tool used by a Vercel employee, gaining access to some non-sensitive environment variables. However, Vercel confirmed that no sensitive data was affected.