Lockfile mirror outage (builds hung on install)
Production builds hung for hours on npm install because package-lock pointed at a dead private registry. Regenerated against registry.npmjs.org.
What happened
All Vercel production builds started timing out after 30+ minutes. No application code had changed. Builds hung on Installing dependencies....
The lockfile had every package resolved URL pointing at a dead private npm mirror (http://35.245.43.102/npm/...). Vercel’s builders could not reach it, so install stalled until the build was killed.
Timeline
| Time | Event |
|---|---|
| ~22:00 | Builds hang 30+ min |
| ~22:00–23:50 | Checked app code, Vercel status — clean |
| ~23:52 | Found lockfile mirror URLs |
| ~23:52 | Regenerated lockfile against registry.npmjs.org |
| ~00:00+ | Builds green |
Fix
Regenerate the lockfile against the public registry and commit it. Never commit a lockfile generated against a private/local registry without checking resolved URLs.
Lesson
A silent hang on install is often infrastructure (lockfile / registry), not product code. Treat package-lock.json as deploy infrastructure.
Adapted from an internal postmortem (Aug 20–21, 2026).