AITOPAI热报
Products

Vercel 构建时自动拦截已知恶意 npm 包

Guillermo Rauch@rauchg
Post
View the post
Why we picked it

Vercel 现在会在构建时自动拦住被劫持的 npm 包，安装脚本还没跑就被挡下，你的密钥不会外泄，啥都不用配。

Vercel 上线了一项供应链安全功能：当 npm 包被劫持时，系统会在构建流程的安装脚本运行之前自动拦截已知恶意包的部署，无需开发者手动操作。该功能旨在防止代码和密钥被外泄，Vercel 将供应链安全列为优先事项。

Original · Guillermo Rauch

Securing the supply chain is one of our top priorities. When npm packages get hijacked, our system blocks their deployment, protecting your code and secrets from exfiltration. Vercel Developers @vercel_dev Vercel now automatically blocks known malicious npm packages in builds before their install scripts can run, no action required. vercel.com/changelog/bloc… 🔗 View Quoted Tweet 💬 85 🔄 10 ❤️ 335 👀 24170 📊 84 ⚡

#Vercel#npm#供应链安全

Keep reading

Recent stories with the same tag or section
ProductsBuildersSelected14:36
Vercel launches agent-desktop for accessibility-tree based desktop automation

The non-obvious point is that accessibility-tree automation trades some visual accuracy for speed and lower token cost, which could make long-running desktop agents far cheaper to operate. Builders experimenting with computer-use agents should test it against vision-based alternatives like Codex's computer use to see where the accuracy-versus-latency tradeoff lands for their workflows.

#Vercel#agent-browser#computer use#agents
Event
Viking@vikingmute2 sourcesSource
ProductsBuildersSelected06:31
Vercel AI Gateway adds virtual model IDs for agents

Routing agents through one virtual ID removes the churn of editing model strings every time a provider ships a new model, and Zero Data Retention can be enforced at the gateway layer rather than per provider. Teams building multi-model agents on Vercel should map their current model references to virtual IDs to simplify upgrades. It competes with direct provider SDK integrations that lack this abstraction layer.

#Vercel#AI Gateway#agents#builders
官方账号Vercel AI@vercelSource