# Source: https://docs.zapier.com/platform/build-cli/inc-547.md

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zapier.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Unauthorized Access to Zapier NPM Packages

**Note: No action is needed from Zapier users**, only from Zapier developers using one of the npm package versions listed below.

All Zapier products are operating as expected and there is no indication of data loss or leak.

## Timeline

* At 5:50AM UTC on 11/24/2025, Zapier became aware that a subset of our npm packages had unauthorized modifications made to them in an apparent supply chain compromise.
* The unauthorized core platform packages were unpublished by 10:30AM UTC.
* The rest were deprecated by 2:03PM UTC.

Please [see this link](https://status.zapier.com/incidents/01KAV9DDHMYT7R6MFHSB8C09E3#updates) for the most up-to-date information.

The list of Zapier npm packages impacted and versions is below along with instructions on how to mitigate impact if you are a Zapier developer.

For Zapier developers, the npm packages listed below were compromised and should not be downloaded or used. They have been unpublished and deprecated from npm and are no longer available. You can find updates here on the Zapier Status Page.

The compromised packages below are used for developing Zapier platform integrations and other Zapier connectors. Please do not install and do not push integration changes using these versions.

## Platform UI developers

If your integration is built on the Platform UI rather than the CLI, check the Versions page of your integration. The Platform Version column will show which package version your integration uses - as long as this is **not** one of versions 18.0.2, 18.0.3, or 18.0.4, your integration is not affected.

<Frame>
    <img src="https://mintcdn.com/zapier-82f0e938/wQj_022fa_mZMaTw/images/versions-page.webp?fit=max&auto=format&n=wQj_022fa_mZMaTw&q=85&s=c2a84c4dd0858f03928a77c0e92ef948" alt="" data-og-width="1518" width="1518" data-og-height="813" height="813" data-path="images/versions-page.webp" data-optimize="true" data-opv="3" srcset="https://mintcdn.com/zapier-82f0e938/wQj_022fa_mZMaTw/images/versions-page.webp?w=280&fit=max&auto=format&n=wQj_022fa_mZMaTw&q=85&s=3a012449b45acf94d3990e8d5bb536a8 280w, https://mintcdn.com/zapier-82f0e938/wQj_022fa_mZMaTw/images/versions-page.webp?w=560&fit=max&auto=format&n=wQj_022fa_mZMaTw&q=85&s=d4f3b296b1715ccb0e3b45ea705cc9a1 560w, https://mintcdn.com/zapier-82f0e938/wQj_022fa_mZMaTw/images/versions-page.webp?w=840&fit=max&auto=format&n=wQj_022fa_mZMaTw&q=85&s=739d4f4e386457b12f9a918c24666805 840w, https://mintcdn.com/zapier-82f0e938/wQj_022fa_mZMaTw/images/versions-page.webp?w=1100&fit=max&auto=format&n=wQj_022fa_mZMaTw&q=85&s=d9be6af66e5fbecef28072f5c9de80e9 1100w, https://mintcdn.com/zapier-82f0e938/wQj_022fa_mZMaTw/images/versions-page.webp?w=1650&fit=max&auto=format&n=wQj_022fa_mZMaTw&q=85&s=ce2dba4a2cdc2f09aee9748173cc18c6 1650w, https://mintcdn.com/zapier-82f0e938/wQj_022fa_mZMaTw/images/versions-page.webp?w=2500&fit=max&auto=format&n=wQj_022fa_mZMaTw&q=85&s=8436ff18556b164dc86a4d8c8fd51fab 2500w" />
</Frame>

This is a quick and easy way to confirm you are not affected. Please also note that we have not seen any integrations using the affected versions despite continued monitoring, and the affected npm package versions have been deprecated and unpublished so that they cannot be used.

## Platform CLI developers

### Recommendation for developers

* What to do if you have downloaded any impacted packages?
  * Re-install the latest version of the package with `npm i <package-name>@latest` (the latest version not impacted will be grabbed).
    * For instance, `npm i zapier-platform-core@latest`
  * Include “-g” for global installation
    * For instance, `npm i -g zapier-platform-cli@latest`
* How to get the latest “good” package?
  * Run `npm i <package-name>@latest`
    * For instance, `npm i zapier-platform-core@latest`
* Make sure no impacted versions are cached:
  * Run `npm cache clean --force`
  * Remove any local `node_modules` files
    * Run `rm -rf node_modules`
  * Remove package-lock.json to ensure fresh package version resolution
    * Run `rm -f package-lock.json`

### Recommendation for partners who maintain integrations

For integration developers, do not push new versions with these packages installed in the timeframe above \[5:50AM UTC to 2:03PM UTC].

If you already pushed a new version with these packages installed, please rotate secrets and private keys with updated values using `zapier env` or through [developer.zapier.com](https://developer.zapier.com).

### Additional questions

If you have any additional questions, you can reach out to Developer Support here: [https://developer.zapier.com/contact](https://developer.zapier.com/contact).

### List of affected packages

* [zapier-platform-cli](https://www.npmjs.com/package/zapier-platform-cli)	18.0.2
* [zapier-platform-cli](https://www.npmjs.com/package/zapier-platform-cli)	18.0.3
* [zapier-platform-cli](https://www.npmjs.com/package/zapier-platform-cli)	18.0.4
* [zapier-platform-core](https://www.npmjs.com/package/zapier-platform-core)	18.0.2
* [zapier-platform-core](https://www.npmjs.com/package/zapier-platform-core)	18.0.3
* [zapier-platform-core](https://www.npmjs.com/package/zapier-platform-core)	18.0.4
* [zapier-platform-legacy-scripting-runner](https://www.npmjs.com/package/zapier-platform-legacy-scripting-runner)	4.0.2
* [zapier-platform-legacy-scripting-runner](https://www.npmjs.com/package/zapier-platform-legacy-scripting-runner)	4.0.3
* [zapier-platform-legacy-scripting-runner](https://www.npmjs.com/package/zapier-platform-legacy-scripting-runner)	4.0.4
* [zapier-platform-schema](https://www.npmjs.com/package/zapier-platform-schema)	18.0.2
* [zapier-platform-schema](https://www.npmjs.com/package/zapier-platform-schema)	18.0.3
* [zapier-platform-schema](https://www.npmjs.com/package/zapier-platform-schema)	18.0.4
* [@zapier/ai-actions](https://www.npmjs.com/package/@zapier/ai-actions)	0.1.18
* [@zapier/ai-actions](https://www.npmjs.com/package/@zapier/ai-actions)	0.1.19
* [@zapier/ai-actions](https://www.npmjs.com/package/@zapier/ai-actions)	0.1.20
* [@zapier/ai-actions-react](https://www.npmjs.com/package/@zapier/ai-actions-react)	0.1.12
* [@zapier/ai-actions-react](https://www.npmjs.com/package/@zapier/ai-actions-react)	0.1.13
* [@zapier/ai-actions-react](https://www.npmjs.com/package/@zapier/ai-actions-react)	0.1.14
* [@zapier/babel-preset-zapier](https://www.npmjs.com/package/@zapier/babel-preset-zapier)	6.4.1
* [@zapier/babel-preset-zapier](https://www.npmjs.com/package/@zapier/babel-preset-zapier)	6.4.2
* [@zapier/babel-preset-zapier](https://www.npmjs.com/package/@zapier/babel-preset-zapier)	6.4.3
* [@zapier/browserslist-config-zapier](https://www.npmjs.com/package/@zapier/browserslist-config-zapier)	1.0.3
* [@zapier/browserslist-config-zapier](https://www.npmjs.com/package/@zapier/browserslist-config-zapier)	1.0.4
* [@zapier/browserslist-config-zapier](https://www.npmjs.com/package/@zapier/browserslist-config-zapier)	1.0.5
* [@zapier/eslint-plugin-zapier](https://www.npmjs.com/package/@zapier/eslint-plugin-zapier)	11.0.3
* [@zapier/eslint-plugin-zapier](https://www.npmjs.com/package/@zapier/eslint-plugin-zapier)	11.0.4
* [@zapier/eslint-plugin-zapier](https://www.npmjs.com/package/@zapier/eslint-plugin-zapier)	11.0.5
* [@zapier/mcp-integration](https://www.npmjs.com/package/@zapier/mcp-integration)	3.0.1
* [@zapier/mcp-integration](https://www.npmjs.com/package/@zapier/mcp-integration)	3.0.2
* [@zapier/mcp-integration](https://www.npmjs.com/package/@zapier/mcp-integration)	3.0.3
* [@zapier/secret-scrubber](https://www.npmjs.com/package/@zapier/secret-scrubber)	1.1.3
* [@zapier/secret-scrubber](https://www.npmjs.com/package/@zapier/secret-scrubber)	1.1.4
* [@zapier/secret-scrubber](https://www.npmjs.com/package/@zapier/secret-scrubber)	1.1.5
* [@zapier/spectral-api-ruleset](https://www.npmjs.com/package/@zapier/spectral-api-ruleset)	1.9.1
* [@zapier/spectral-api-ruleset](https://www.npmjs.com/package/@zapier/spectral-api-ruleset)	1.9.2
* [@zapier/spectral-api-ruleset](https://www.npmjs.com/package/@zapier/spectral-api-ruleset)	1.9.3
* [@zapier/stubtree](https://www.npmjs.com/package/@zapier/stubtree)	0.1.2
* [@zapier/stubtree](https://www.npmjs.com/package/@zapier/stubtree)	0.1.3
* [@zapier/stubtree](https://www.npmjs.com/package/@zapier/stubtree)	0.1.4
* [@zapier/zapier-sdk](https://www.npmjs.com/package/@zapier/stubtree)	0.15.5
* [@zapier/zapier-sdk](https://www.npmjs.com/package/@zapier/stubtree)	0.15.6
* [@zapier/zapier-sdk](https://www.npmjs.com/package/@zapier/stubtree)	0.15.7
* [redux-router-kit](https://www.npmjs.com/package/redux-router-kit)	1.2.2
* [redux-router-kit](https://www.npmjs.com/package/redux-router-kit)	1.2.3
* [redux-router-kit](https://www.npmjs.com/package/redux-router-kit)	1.2.4
* [zapier-async-storage](https://www.npmjs.com/package/zapier-async-storage)	1.0.1
* [zapier-async-storage](https://www.npmjs.com/package/zapier-async-storage)	1.0.2
* [zapier-async-storage](https://www.npmjs.com/package/zapier-async-storage)	1.0.3
* [zapier-scripts](https://www.npmjs.com/package/zapier-scripts)	7.8.3
* [zapier-scripts](https://www.npmjs.com/package/zapier-scripts)	7.8.4