- Vercel scans lockfiles and blocks known malicious npm package versions before and during dependency installation.
- If a blocked package is detected, the deployment fails with an error and the build cache is invalidated, requiring an update to a safe version.
- The protection is automatic for all plans with no configuration required.