HN

Need help?
<- Back
Zod 4.6.6 compromised by malware?

Zod 4.6.6 compromised by malware?

luggage_bazooka

Comments (34)

  • jaynetics
    The compromised code wasn't actually released. This write-up has a lot of information:https://github.com/orgs/community/discussions/208477
  • yuvalkarmi
    This is 3 weeks back, folks. It WAS real repository compromise - it made it to Zod's main, but not to npm.On September 21, someone used Colin's git credentials to push this compromised code into the project, Colin caught it, and reverted it that same day (PR #6620). He subsequently did release 4.6.6 on October 11, but it did NOT contain the infected code.Btw, Zod wasn't the only package targeted - same attack was attempted against standard-schema and nub. Nub DID make it to npm, but npm's malware scanning blocked it.Looks like a legit (well, illegitimate) attempted supply-chain attack, but no actual Zod release was compromised.
  • Meneth
    The compromised code is still tagged on Github as of 2026-10-12T10:37:51: https://github.com/colinhacks/zod/releases/tag/v4.6.6. See commit d821685.
  • jaapz
    Might is pretty tame, it is infected - EDIT: title was changed, it said "might be infected".The malware seems to inject some JS payload to execute when zod is installed, by fetching it from an ethereum smart contract (if I understand it correctly).Don't forget to flag the version on npm.EDIT: looks like the update never got on NPM: https://news.ycombinator.com/item?id=50053253
  • luggage_bazooka
    The most recent version 4.6.6 has a very interesting commit (d821685) "Fix bugs and improve performance", that contain the following changes https://github.com/colinhacks/zod/commit/d821685ea6732436fcd...I didn't study what packages/mini/meta.test.mjs is doing in particular but it's not looking great
  • Jarred
    I haven’t downloaded the tarball to verify, but it looks like it was reverted prior to the GitHub release:https://github.com/colinhacks/zod/commit/10dda3a3a4bc76ed0bf...
  • xx_ns
    Interestingly, they added the `preinstall` key (that is supposed to run the malicious script when installed) under the package.json root, and not under `scripts`, so from what I can tell this wouldn't run on install.Otherwise, yeah, this seems like a stage-1 loader for fetching and running a payload off the Ethereum mainnet.
  • anon
    undefined
  • hizlikovboy27
    I have many projects using this library. do u think the situtation is urgent, a code red? I will need to talk to clients accordingly.
  • citbl
    This is so bad it doesn't even try to hide itself.
  • eviks
    > colinHACKsname checks out
  • throwawayy6767
    What are we looking at exactly? Gia Tan situation? Prompt injection?
  • anon
    undefined
  • MisterMunchkin
    That is 100% a compromised repo. It's a malware downloader.I feel like they could have done a better job here. Having just a few changes, one of which is a huge blob of blatantly compromising code, is just too obvious.The URLs are interesting, I don't do anything in this area but I didn't know that you could use the blockchains to hide your command and control URL, in a way that allows you to remotely update the URL whenever you want. It turns out there is a use for blockchain! Making control URLs immune to takedowns!
  • blueblazin
    How is this even possible? The change is small and literally has an ethereum URL in the code changes. How did it go through?
  • anon
    undefined
  • erzhan89
    malicious remote-code loader
  • SquidJack
    [flagged]
  • rfgplk
    [flagged]
  • oraro
    classic crypto people doing classic crypto things
  • rarisma
    Yep, def looks bad.Just pasted the code into claude to try and decipher the minified js and looks like it tries to find the server via the blockchain? and then download further stuff from there.