Vercel–Axios supply hack

Vercel said on April 19 that attackers got into some internal systems and accessed customer data after compromising a third-party AI app tied to an employee’s Google account. (vercel.com, techcrunch.com) The path into Vercel did not start with Vercel’s code. Context said a March breach of its consumer “Office Suite” product likely exposed OAuth tokens, and one of those tokens was then used to access a Vercel employee’s Google Workspace account. (context.ai, techcrunch.com) OAuth is the “Sign in with Google” plumbing that lets one app act on another app’s behalf. Context said at least one Vercel employee had granted its consumer app “Allow All” permissions, which gave the stolen token unusually broad reach inside Vercel’s Google environment. (context.ai) Vercel told customers earlier, on March 31, to watch for the separate Axios npm compromise, which poisoned versions 1.14.1 and 0.30.4 of the JavaScript package and pushed malware at install time. Microsoft said that attack was attributed to Sapphire Sleet, a North Korean state actor. (community.vercel.com, microsoft.com) The Axios incident and the Vercel breach are different attacks, but they hit the same trust layer: tools developers install automatically and apps employees connect to work accounts. In both cases, the attacker went after a trusted middleman instead of trying to trick each end user one by one. (microsoft.com, context.ai, techcrunch.com) What Vercel says was exposed is narrower than the online sales pitch from the attacker. TechCrunch reported that the seller claimed to have API keys, source code, and database data for $2 million, while Vercel said it contacted customers whose app data and keys were compromised and told others there was no evidence their credentials or private data were affected. (techcrunch.com, lilting.ch) Vercel also said its open-source projects Next.js and Turbopack were not affected. The company’s March Axios advisory had already warned developers to rotate secrets, redeploy, and pin safe package versions after the npm compromise. (techcrunch.com, community.vercel.com) Context drew a line between its old consumer product and its current enterprise business. It said the affected Office Suite was released in June 2025, shut down after the March incident, and was separate from its enterprise deployments, which it said run in customer environments and were not impacted. (context.ai) The immediate lesson is not about one library or one cloud host. It is that a stolen token or a poisoned dependency can turn a routine developer shortcut into access across build systems, deployment pipelines, and customer secrets in a single hop. (microsoft.com, techcrunch.com, context.ai)