The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables

Executive summary: This report analyzes the April 2026 Vercel OAuth supply‑chain compromise originating from a Lumma Stealer infection at Context.ai that allowed exfiltration of Google Workspace OAuth tokens and lateral movement into Vercel, where attackers enumerated non‑sensitive environment variables for a limited set of customer projects; the analysis maps the attack chain to MITRE ATT&CK, documents timeline and confirmation status, lists a confirmed IoC (Context.ai OAuth Client ID), evaluates design and governance failings (default non‑sensitive env vars), and provides detection, hunting, and remediation guidance for affected organizations.