Security Alert: Malicious Code Injection Found in Zod Library Commit

This commit updates the Zod library to version 4.6.6 and automates its release workflow via GitHub Actions. However, it also introduces a malicious 'preinstall' script that executes obfuscated code fetched from remote sources via Ethereum RPC nodes. This change effectively turns a standard library update into a vehicle for a supply chain attack.

Key Points

• The commit increments the version of 'zod' and '@zod/mini' to 4.6.6.
• The GitHub Actions release workflow was updated to automate npm releases upon changes to package.json files in the main branch.
• A highly suspicious 'preinstall' script was added to both packages, ensuring code execution immediately upon installation.
• The added 'meta.test.mjs' script uses Ethereum blockchain RPCs as a decentralized mechanism to fetch and run remote, obfuscated payloads.
• The patch version was manually updated in the source code core files to reflect the new 4.6.6 versioning.

Sentiment

The community is concerned and critical about the attempted compromise, but the prevailing view is more corrective than panicked: commenters broadly accept that the code was malicious while also emphasizing that Zod's npm release was not compromised. Sentiment toward the article's warning is mostly validating on the existence of the attack, but skeptical of any framing that suggests users installed a malicious Zod package.

In Agreement

• The commit is clearly malicious, with code that appears to resolve a payload location through Ethereum RPC infrastructure and execute additional JavaScript.
• The incident is a legitimate supply-chain attack against a major dependency, even if the final package release was not compromised.
• Install-time package scripts remain a serious ecosystem risk, and disabling or constraining lifecycle scripts is an important defense.
• Leaving the compromised commit visible in release notes or repository history created avoidable confusion and could affect workflows such as bisecting.

Opposed

• Several commenters reject the implication that Zod users received a malicious npm release, emphasizing that the compromised code was reverted before publication.
• The maintainer and others argue that Zod's release CI was already designed to resist this exact class of credential compromise through trusted publishing and protected release environments.
• Some participants caution that removing commits from public history is not obviously better from a security standpoint, even though others found the retained history concerning.
• A few commenters push back on framing this as uniquely a JavaScript or Zod problem, arguing that dependency and validation-library risks exist in other ecosystems too.