Historical disclosure revision 1
Disclosures and evidence
Revision 1 of 2 · Evidence cutoff Nov 24, 2025, 11:59 PM UTC
0 prior statements preserved · 9 statements added. Attributed source statements retain the source’s qualifications.
What the company disclosed
Zapier stated: “At around 5:50 AM UTC on November 24, 2025, Zapier became aware that a subset of our NPM packages were involved in a supply chain compromise that injected malicious code in their packages.” Status update: 2025-11-24T15:58:41Z (investigating).
Operational impact
Zapier stated: “At this time, all Zapier products are operating as expected and are not known to be affected.” Status update: 2025-11-24T15:58:41Z (investigating).
Zapier stated: “Zapier Functions is currently offline out of an abundance of caution. For updates about Functions specifically, you can follow along here: https://status.zapier.com/incidents/01KAVFSJ0GVZJ24WW3GJ9BK7G7.” Status update: 2025-11-24T18:02:56.557Z (monitoring).
Response
Zapier stated: “Affected versions have been deprecated, and developers can use the latest versions to ensure they're unaffected.” Status update: 2025-11-24T15:58:41Z (investigating).
Zapier stated: “Our team is currently investigating.” Status update: 2025-11-24T15:58:41Z (investigating).
Zapier stated: “Our Engineering and Security team are continuing to monitor this situation.” Status update: 2025-11-24T18:02:56.557Z (monitoring).
Zapier stated: “Communications and guidance have been sent to Zapier Developers with the following guidance:” Status update: 2025-11-24T19:20:29.046Z (resolved).
Zapier stated: “• For integration developers make sure that you have **_not_** pushed new versions with these packages installed in the timeframe above [5:50AM UTC to 2:03PM UTC].” Status update: 2025-11-24T19:20:29.046Z (resolved).
Zapier stated: “If you pushed a new version with these packages installed, please rotate secrets and private keys with updated values using zapier env or through [developer.zapier.com](http://developer.zapier.com).” Status update: 2025-11-24T19:20:29.046Z (resolved).
Disclosure sources and provenance
- Zapier Publisher posted November 24, 2025Document form: PUBLIC_DISCLOSUREPublisher HTTPS source · Retrieved Oct 7, 2026, 6:07 PM UTC · Retained Oct 7, 2026, 6:07 PM UTC
- Current captured representation; historical byte snapshots are unknown.
Evidence limitations
- Attributed publisher/researcher reports establish what was reported, not independent verification of criminal activity or unique affected humans.
- Current captured representations support controlled retrospective disclosure views; actual historical byte snapshots are unknown.