A deep technical breakdown of the April 2026 Vercel security incident — supply chain risks, GitHub token exposure, NPM hijacking, and what you need to rotate right now It started, as many supply chain nightmares do, quietly. Today, Vercel — the cloud platform powering millions of production deployments, the company behind Next.js, the infrastructure quietly sitting between your code and your use