TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A GitHub commit adding version 4.6.6 to Zod and Zod Mini also adds a preinstall script that retrieves and runs remote code. The supplied material does not confirm whether the packages were published to npm, how long they were available, or whether users installed them.
A GitHub commit in the Zod repository adds a preinstall script to the Zod and Zod Mini package manifests for version 4.6.6, alongside code that contacts remote services, downloads a payload and attempts to run setup code. The diff is consistent with a malicious package change, but the source provided does not establish whether version 4.6.6 was published to npm or installed by users.
The cited commit, identified as d821685ea6732436fcdf786a81d076958471e467, changes the versions of zod, @zod/zod and @zod/mini from 4.6.5 to 4.6.6. It adds a file called meta.test.mjs and a package preinstall hook that runs that file. The same newly added script imports filesystem, operating-system and path utilities, then makes requests to Ethereum RPC services and addresses returned through those requests.
According to the code in the cited GitHub diff, the script processes the response for remote locations, fetches a /loader resource, and looks for data containing a setup script and a base64-encoded payload. If it receives the expected fields, it writes the payload to a temporary directory, imports the setup code and invokes a global setup function. It then attempts to remove the temporary directory. These operations are visible in the supplied diff; the diff alone does not show what the fetched payload contains or whether the requests succeeded.
The same commit also changes the release workflow: it adds a push trigger on the main branch when either package manifest changes, while retaining a manual workflow trigger. The excerpt does not document whether that workflow ran, whether npm packages were produced, or whether a release was approved. Those distinctions matter: a dangerous change in source control does not by itself establish that users received a compromised package.
Risk to Zod Package Installations
Zod is a JavaScript and TypeScript validation library, and package managers can run lifecycle scripts such as preinstall during installation. If this version was published with the shown hook, installing it could execute code before a project begins using the library. The visible script in the cited commit is designed to obtain additional instructions and a payload at runtime, which means the behavior cannot be fully judged from the package diff alone.
For developers, the immediate concern is whether they installed the affected version and whether installation took place in an environment with access to sensitive files, credentials or network resources. The supplied source does not confirm any data theft, system compromise, or other specific payload outcome. Those should not be reported as established incidents without further evidence.
The episode also highlights a supply-chain distinction: a suspicious commit, a package published to a registry, and a successful installation are separate events. Establishing each step helps maintainers and users judge exposure and take proportionate action rather than treating repository code as proof that every consumer was affected.
JavaScript security tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the Commit Changes
The cited commit excerpt shows coordinated edits to package metadata and release automation. All three named package manifests move from 4.6.5 to 4.6.6; the two principal package manifests shown, zod and @zod/mini, receive the same preinstall entry and the new script file. Zod’s source-level version constant is also incremented to patch version 6.
The release workflow change adds an automatic trigger for pushes to main when either package.json changes. The earlier workflow comment says a version bump by itself publishes nothing and describes a maintainer manually running the release workflow and approving the npm environment. The diff therefore changes release conditions, but does not prove publication. No registry record, maintainer statement, incident analysis or independent security report is included in the supplied material.
Publication and Exposure Still Unverified
The available source is a GitHub commit diff, not confirmation from npm or a Zod maintainer. It does not establish whether 4.6.6 was published, when it may have been available, whether the suspicious commit remained in the repository, or whether the release workflow ran. It also supplies no package download figures or evidence of successful installations.
The remote payload’s contents and any effects are unknown from the excerpt. The listed network requests and execution flow indicate an attempt to retrieve and run code, but do not verify that a server responded, that setup completed, or that information was accessed or transmitted. The compromise question is therefore best framed as a serious apparent malicious change whose distribution and impact remain unconfirmed in the provided evidence.
Verify Registry and Maintainer Updates
The key next checks are whether the affected version appeared on npm, whether it has been removed or deprecated, and whether the repository’s maintainers publish an account of the commit and release process. Registry timestamps, package tarballs and reproducible comparisons with the GitHub source could help establish what users could have installed.
Until those details are confirmed, projects should check their lockfiles and installation records for 4.6.6 of the named packages and consult official maintainer or registry guidance before taking action. If an organization finds the version in an environment, its response should follow its security procedures and be based on evidence about the package and installation—not an assumption that the payload’s effects are already known.
Key Questions
Does the commit prove Zod 4.6.6 was published with malware?
No. It shows a suspicious preinstall hook and remote-code execution logic in the cited repository changes. The supplied material does not confirm that the version was published to npm or installed.
Which packages are named in the diff?
The excerpt changes versions for zod, @zod/zod and @zod/mini from 4.6.5 to 4.6.6. It shows the preinstall hook in the zod and @zod/mini manifests.
What does the added script appear to do?
It queries remote services, attempts to retrieve loader data and a payload, writes payload data into a temporary directory, and imports setup code. The excerpt does not reveal the payload’s contents or establish that execution succeeded.
Is there evidence that users’ data was stolen?
No evidence of data theft is included in the supplied source. The diff supports concern about attempted remote code execution, but specific effects remain unverified.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
