@amedit/vercel-builder-probe (npm) · Malicious Code
Affects @amedit/vercel-builder-probeSource GCVE Database
Malicious package : remove @amedit/vercel-builder-probe and rotate any secrets on hosts that installed it.
Data as of 12 Sep 2026, 16:03 UTC
Malicious package
Published to npm · OSV MAL-2026-10548
What to do
Remove @amedit/vercel-builder-probe from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@amedit/vercel-builder-probe | Affected– | Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The @amedit/vercel-builder-probe npm package contains malicious code that, when used as a @vercel/build-utils Builder in a Vercel deployment pipeline, leaks sensitive environment variables including JWTs and deployment keys into build logs. It also forges JWT signatures using the installer's deployment key and sends unauthorized requests to a third party's internal Vercel endpoint. This exposes the installer's secrets and risks abuse-policy enforcement actions. The package is considered fully compromising to any system where it is installed.
References
- github.com/advisories/GHSA-wvc3-vq7q-w2mw (opens in a new tab)
- npmjs.com/package/@amedit/vercel-builder-probe/v/1.0.2 (opens in a new tab)
- npmjs.com/package/@amedit/vercel-builder-probe/v/1.0.3 (opens in a new tab)
- npmjs.com/package/@amedit/vercel-builder-probe/v/1.0.1 (opens in a new tab)
- npmjs.com/package/@amedit/vercel-builder-probe/v/1.0.0 (opens in a new tab)