Zapier Security Incident - NPM Packages and Zapier Developers

Our Engineering and Security team are continuing to monitor this situation.

Zapier Functions is currently offline out of an abundance of caution. For updates about Functions specifically, you can follow along here: https://status.zapier.com/incidents/01KAVFSJ0GVZJ24WW3GJ9BK7G7.

Below is a list of affected packages and versions:

• zapier-platform-cli : https://www.npmjs.com/package/zapier-platform-cli18.0.2

• zapier-platform-cli : https://www.npmjs.com/package/zapier-platform-cli18.0.3

• zapier-platform-cli : https://www.npmjs.com/package/zapier-platform-cli18.0.4

• zapier-platform-core : https://www.npmjs.com/package/zapier-platform-core18.0.2

• zapier-platform-core : https://www.npmjs.com/package/zapier-platform-core18.0.3

• zapier-platform-core : https://www.npmjs.com/package/zapier-platform-core18.0.4

• zapier-platform-legacy-scripting-runner : https://www.npmjs.com/package/zapier-platform-legacy-scripting-runner4.0.2

• zapier-platform-legacy-scripting-runner : https://www.npmjs.com/package/zapier-platform-legacy-scripting-runner4.0.3

• zapier-platform-legacy-scripting-runner : https://www.npmjs.com/package/zapier-platform-legacy-scripting-runner4.0.4

• zapier-platform-schema : https://www.npmjs.com/package/zapier-platform-schema18.0.2

• zapier-platform-schema : https://www.npmjs.com/package/zapier-platform-schema18.0.3

• zapier-platform-schema : https://www.npmjs.com/package/zapier-platform-schema18.0.4



• @zapier/ai-actions : https://www.npmjs.com/package/@zapier/ai-actions0.1.18

• @zapier/ai-actions : https://www.npmjs.com/package/@zapier/ai-actions0.1.19

• @zapier/ai-actions : https://www.npmjs.com/package/@zapier/ai-actions0.1.20

• @zapier/ai-actions-react : https://www.npmjs.com/package/@zapier/ai-actions-react0.1.12

• @zapier/ai-actions-react : https://www.npmjs.com/package/@zapier/ai-actions-react0.1.13

• @zapier/ai-actions-react : https://www.npmjs.com/package/@zapier/ai-actions-react0.1.14

• @zapier/babel-preset-zapier : https://www.npmjs.com/package/@zapier/babel-preset-zapier6.4.1

• @zapier/babel-preset-zapier : https://www.npmjs.com/package/@zapier/babel-preset-zapier6.4.2

• @zapier/babel-preset-zapier : https://www.npmjs.com/package/@zapier/babel-preset-zapier6.4.3

• @zapier/browserslist-config-zapier : https://www.npmjs.com/package/@zapier/browserslist-config-zapier1.0.3

• @zapier/browserslist-config-zapier : https://www.npmjs.com/package/@zapier/browserslist-config-zapier1.0.4

• @zapier/browserslist-config-zapier : https://www.npmjs.com/package/@zapier/browserslist-config-zapier1.0.5

• @zapier/eslint-plugin-zapier : https://www.npmjs.com/package/@zapier/eslint-plugin-zapier11.0.3

• @zapier/eslint-plugin-zapier : https://www.npmjs.com/package/@zapier/eslint-plugin-zapier11.0.4

• @zapier/eslint-plugin-zapier : https://www.npmjs.com/package/@zapier/eslint-plugin-zapier11.0.5

• @zapier/mcp-integration : https://www.npmjs.com/package/@zapier/mcp-integration3.0.1

• @zapier/mcp-integration : https://www.npmjs.com/package/@zapier/mcp-integration3.0.2

• @zapier/mcp-integration : https://www.npmjs.com/package/@zapier/mcp-integration3.0.3

• @zapier/secret-scrubber : https://www.npmjs.com/package/@zapier/secret-scrubber1.1.3

• @zapier/secret-scrubber : https://www.npmjs.com/package/@zapier/secret-scrubber1.1.4

• @zapier/secret-scrubber : https://www.npmjs.com/package/@zapier/secret-scrubber1.1.5

• @zapier/spectral-api-ruleset : https://www.npmjs.com/package/@zapier/spectral-api-ruleset1.9.1

• @zapier/spectral-api-ruleset : https://www.npmjs.com/package/@zapier/spectral-api-ruleset1.9.2

• @zapier/spectral-api-ruleset : https://www.npmjs.com/package/@zapier/spectral-api-ruleset1.9.3

• @zapier/stubtree : https://www.npmjs.com/package/@zapier/stubtree0.1.2

• @zapier/stubtree : https://www.npmjs.com/package/@zapier/stubtree0.1.3

• @zapier/stubtree : https://www.npmjs.com/package/@zapier/stubtree0.1.4

• @zapier/zapier-sdk : https://www.npmjs.com/package/@zapier/stubtree0.15.5

• @zapier/zapier-sdk : https://www.npmjs.com/package/@zapier/stubtree0.15.6

• @zapier/zapier-sdk : https://www.npmjs.com/package/@zapier/stubtree0.15.7

• redux-router-kit : https://www.npmjs.com/package/redux-router-kit1.2.2

• redux-router-kit : https://www.npmjs.com/package/redux-router-kit1.2.3

• redux-router-kit : https://www.npmjs.com/package/redux-router-kit1.2.4

• zapier-async-storage : https://www.npmjs.com/package/zapier-async-storage1.0.1

• zapier-async-storage : https://www.npmjs.com/package/zapier-async-storage1.0.2

• zapier-async-storage : https://www.npmjs.com/package/zapier-async-storage1.0.3

• zapier-scripts : https://www.npmjs.com/package/zapier-scripts7.8.3

• zapier-scripts : https://www.npmjs.com/package/zapier-scripts7.8.4

At around 5:50 AM UTC on November 24, 2025, Zapier became aware that a subset of our NPM packages were involved in a supply chain compromise that injected malicious code in their packages.

Affected versions have been deprecated, and developers can use the latest versions to ensure they're unaffected.

At this time, all Zapier products are operating as expected and are not known to be affected.

Our team is currently investigating.