Vercel has confirmed unauthorized access to internal systems via a supply-chain pivot: a Lumma Stealer infection on a third-party employee’s unmanaged device harvested Google Workspace OAuth tokens that were replayed to access Vercel’s internal infrastructure. Customer environment variables were exposed, with downstream risk to any secrets stored in Vercel projects including database credentials, API keys, and OAuth application secrets. Five discrete platform CVEs affecting Next.js and Turbopack are separately in scope and require patching independent of the breach response.