Hacker Active Well Beyond Context.ai Compromise, Says Vercel CEO

**Executive summary:** Vercel disclosed that a threat actor distributed malware (Lumma Stealer) and used social engineering to steal tokens and keys from developer machines, resulting in unauthorized API usage and enumeration of non-sensitive environment variables across multiple customer accounts; the company identified additional accounts with prior independent compromise, has notified affected customers, and confirmed no evidence of tampering of Vercel-published npm packages.