--- title: Zod 4.6.6 compromised by malware? | daily.dev description: A commit labeled as a bug fix and performance improvement to the popular zod TypeScript validation library actually injects obfuscated malicious JavaScript.... canonical: https://daily.dev/posts/zod-4-6-6-compromised-by-malware--iczm2xmek twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Zod 4.6.6 compromised by malware? | daily.dev og:description: A commit labeled as a bug fix and performance improvement to the popular zod TypeScript validation library actually injects obfuscated malicious JavaScript.... og:url: https://daily.dev/posts/zod-4-6-6-compromised-by-malware--iczm2xmek og:image: https://api.daily.dev/og/posts/IcZM2xmek.png og:image:alt: Zod 4.6.6 compromised by malware? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Zod 4.6.6 compromised by malware? **[Hacker News](https://daily.dev/sources/hn)** · 1 min read · 7 upvotes · 2 comments ## Summary A commit labeled as a bug fix and performance improvement to the popular zod TypeScript validation library actually injects obfuscated malicious JavaScript. The code queries an Ethereum smart contract via eth_call to resolve a hidden domain, fetches a loader payload from it, writes it to a temp directory, and dynamically imports and executes it, then cleans up traces. This pattern matches a blockchain-based command-and-control supply chain attack targeting a widely used open source package. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does this zod commit labeled as a bug fix contain obfuscated JavaScript calling eth_call? The commit, despite being labeled a bug fix and performance improvement, contains obfuscated code that queries an Ethereum smart contract through eth_call to resolve a hidden command-and-control domain. It then fetches a payload from a loader endpoint, writes it to a temp directory, and dynamically imports and executes it before deleting the evidence, a pattern consistent with blockchain-based malware delivery in a supply chain attack. _Developers auditing dependency updates for hidden compromises can track incidents like this zod commit on daily.dev._ ### How does blockchain-based malware hide its command-and-control server from static analysis? It stores the actual payload domain encoded inside data returned by a smart contract call, such as eth_call against a given contract address, rather than hardcoding the domain in the malicious script. The malware decodes the returned value at runtime to get the real host, fetches a loader JSON file, and only then downloads and executes the actual payload, evading static URL-based detection. _Teams hardening CI pipelines against disguised payloads can follow write-ups like this zod incident on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 51 comments across hackernews (as of 2026-10-12). **TL;DR:** The injected code was a real blockchain-based C2 malware loader from a compromised git credential, but it never reached npm because Zod's trusted-publishing pipeline blocked it; debate centers on whether leaving the commit visible in git history/releases was acceptable. **Sentiment:** 10% positive · 55% mixed · 35% skeptical **The case for** - Zod's release pipeline used environment-scoped trusted publishing requiring 2FA, which actually prevented the malicious code from being published to npm. - The maintainer responded transparently, revoked credentials, reinstalled his OS, and migrated to staged publishing requiring 2FA for all releases. **The pushback** - Leaving the compromised commit visible in git history and tagged on the GitHub release page for weeks was seen as careless and not inspiring confidence in the project's security practices. - npm's own security advisory was criticized as misleading, implying Zod releases were caught by malware scanning when no Zod release was ever submitted. - Some think a 'compromised release was cut' at all reflects poorly on process, even though it never reached npm. **By community** - hackernews (mixed): Extended thread clarifying that the malware never shipped to npm thanks to hardened publishing, with disagreement over how alarming the situation really was and criticism of leaving the commit in git history. **Hottest debate:** Whether it's fair to call this an actual 'compromised release' given the malicious commit reached GitHub and the release tag but never npm, due to trusted-publishing protections. **Open questions** - Why the compromised commit was left visible in git history and on the release page for weeks before being addressed. - How exactly the attacker's git push credential (likely an SSH key) was exfiltrated from the maintainer's machine. **Highlights** > Zod maintainer here. As others have noted, no malware was shipped in any release. This was three weeks ago, and it was caught very quickly. All my git and npm credentials were immediately revoked to prevent further access. There's a security writeup from the NPM team here. [0] It seems like a git push credential, probably an SSH key, was exfiltrated from my local computer. The attacker used this to try to push malicious versions of Zod, Standard Schema, and nub. The release workflows for Zod and Standard Schema were already hardened against this (environment-scoped trusted publishing, which requires an npm credential), so it was not possible to trigger a release via simple commits/tags. Nub's release CI was triggered, and npm flagged the malware before it went out. npm's own security advisory is misleading in this regard and strongly implies that malicious versions of Zod were caught by their malware scanner; that's not the case. Zod's own releasing CI was not vulnerable to this kind of attack. It seemed shady to scrub the commits from history, and it still isn't clear to me that doing so is better from a security standpoint. But since there are concerns around git bisect, etc, I've done so anyway. v4.6.6 will lose provenance, v4.6.7 is being released. All my packages have been switched over to staged trusted publishing, which requires 2FA for any release. Since I don't know exactly what else what compromised, I've also done a fresh OS re-install and rotated all creds present on the old machine at the time of the compromise. Ironically this likely happened due to some work on an OS-level sandbox for Nub's package manager, designed to limit the blast radius of malicious lifecycle scripts. The attack is consistent with an more primitive precursor to the modern Shai-Hulud-style worms. While working on the sandbox, an ersatz agent likely executed a compromised version of some package on npm in a test run. I had safeguards against this (filtering out any OSV-flagged packages, etc) but perhaps there's an undiscovered malicious package. Future work on this feature will happen on an isolated VM. [0] https://github.com/orgs/community/discussions/208477 > — [colinmcd on hackernews](https://news.ycombinator.com/item?id=50057591) > From the repo owner: > Seems like a git push credential of some kind was compromised, not an npm or GitHub token. Still working with the GitHub team to get some better forensics on what/how. The attack consisted of malicious commits and tagged pushes to main. So it didn't go through review, it was pushed straight to main. It also seems their publishing pipeline was already secured against this sort of thing: > Zod's release flow was already secured against kind of attack via trusted publishing and a dedicated GitHub environment for secure deployments. Zod's release CI worked as designed and was already secure against this; NPM's malware scanning didn't prevent any malicious here. > — [ozyschmozy on hackernews](https://news.ycombinator.com/item?id=50053398) > The commit was still not only in git history, but also on the release page on github for 4.6.6: https://github.com/colinhacks/zod/releases/tag/v4.6.6 So I think it's not a great leap to think this commit actually made it to 4.6.6 on npm. Good that it didn't though! > — [jaapz on hackernews](https://news.ycombinator.com/item?id=50055647) > This is 3 weeks back, folks. It WAS real repository compromise - it made it to Zod's main, but not to npm. On September 21, someone used Colin's git credentials to push this compromised code into the project, Colin caught it, and reverted it that same day (PR #6620). He subsequently did release 4.6.6 on October 11, but it did NOT contain the infected code. Btw, Zod wasn't the only package targeted - same attack was attempted against standard-schema and nub. Nub DID make it to npm, but npm's malware scanning blocked it. Looks like a legit (well, illegitimate) attempted supply-chain attack, but no actual Zod release was compromised. > — [yuvalkarmi on hackernews · 2 comments](https://news.ycombinator.com/item?id=50053402) > That is 100% a compromised repo. It's a malware downloader. I feel like they could have done a better job here. Having just a few changes, one of which is a huge blob of blatantly compromising code, is just too obvious. The URLs are interesting, I don't do anything in this area but I didn't know that you could use the blockchains to hide your command and control URL, in a way that allows you to remotely update the URL whenever you want. It turns out there is a use for blockchain! Making control URLs immune to takedowns! > — [MisterMunchkin on hackernews](https://news.ycombinator.com/item?id=50053226) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50052814) · 165 points · 51 comments ## Community discussion Top comments from developers on daily.dev. **@deepjoshi\_dev** · 0 upvotes > This is giving me hebby chabies in a bad way. **@petecapecod** · 0 upvotes > Ugh noooooo that sucks 😭 not zod!! This is why I use socket firewall on all my stuffs ## Similar posts on daily.dev - [Evolution of Web3 in Cloud Supply Chain Attacks](https://daily.dev/posts/evolution-of-web3-in-cloud-supply-chain-attacks-3unzi5cdy) · Unit 42 · 0 upvotes · 0 comments - [5 Malicious npm Packages Typosquat Solana and Ethereum Libra...](https://daily.dev/posts/5-malicious-npm-packages-typosquat-solana-and-ethereum-libra--gayqpslsx) · Socket · 3 upvotes · 0 comments - [Miasma: Red Hat Cloud Services npm Packages Hit by a Mini Shai-Hulud-Style Campaign](https://daily.dev/posts/miasma-red-hat-cloud-services-npm-packages-hit-by-a-mini-shai-hulud-style-campaign-4kacs0e4h) · Security Boulevard · 0 upvotes · 0 comments - [Node-gyp Supply Chain Compromise](https://daily.dev/posts/node-gyp-supply-chain-compromise-fjrma3w8k) · Snyk · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm), [#zod](https://daily.dev/tags/zod) [View this post on daily.dev](https://daily.dev/posts/zod-4-6-6-compromised-by-malware--iczm2xmek) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Zod 4.6.6 compromised by malware?","url":"https://daily.dev/posts/zod-4-6-6-compromised-by-malware--iczm2xmek","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/zod-4-6-6-compromised-by-malware--iczm2xmek"},"datePublished":"2026-10-12T09:02:51.552Z","dateModified":"2026-10-12T16:48:50.308Z","description":"A commit labeled as a bug fix and performance improvement to the popular zod TypeScript validation library actually injects obfuscated malicious JavaScript....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/28b5cf4560d43127f3b69b99834e4d4b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/28b5cf4560d43127f3b69b99834e4d4b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":2,"discussionUrl":"https://daily.dev/posts/zod-4-6-6-compromised-by-malware--iczm2xmek","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"keywords":"cyber,malware,npm,zod","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Zod 4.6.6 compromised by malware?"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/zod-4-6-6-compromised-by-malware--iczm2xmek","comment":[{"@type":"Comment","text":"This is giving me hebby chabies in a bad way.","datePublished":"2026-10-12T12:53:35.534Z","url":"https://daily.dev/posts/IcZM2xmek#c-dGTchC1ei","author":{"@type":"Person","name":"Deep Joshi","url":"https://daily.dev/deepjoshi_dev","image":"https://media.daily.dev/image/upload/s--TdY8j8Aa--/f_auto/v1776506972/avatars/avatar_aSUkzUQS97QJpQRxKMe49?_a=BAMAMiWQ0"}},{"@type":"Comment","text":"Ugh noooooo that sucks 😭 not zod!! This is why I use socket firewall on all my stuffs","datePublished":"2026-10-12T13:54:43.535Z","url":"https://daily.dev/posts/IcZM2xmek#c-GyXly5IRW","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/zod-4-6-6-compromised-by-malware--iczm2xmek#faq","mainEntity":[{"@type":"Question","name":"Why does this zod commit labeled as a bug fix contain obfuscated JavaScript calling eth_call?","acceptedAnswer":{"@type":"Answer","text":"The commit, despite being labeled a bug fix and performance improvement, contains obfuscated code that queries an Ethereum smart contract through eth_call to resolve a hidden command-and-control domain. It then fetches a payload from a loader endpoint, writes it to a temp directory, and dynamically imports and executes it before deleting the evidence, a pattern consistent with blockchain-based malware delivery in a supply chain attack. Developers auditing dependency updates for hidden compromises can track incidents like this zod commit on daily.dev."}},{"@type":"Question","name":"How does blockchain-based malware hide its command-and-control server from static analysis?","acceptedAnswer":{"@type":"Answer","text":"It stores the actual payload domain encoded inside data returned by a smart contract call, such as eth_call against a given contract address, rather than hardcoding the domain in the malicious script. The malware decodes the returned value at runtime to get the real host, fetches a loader JSON file, and only then downloads and executes the actual payload, evading static URL-based detection. Teams hardening CI pipelines against disguised payloads can follow write-ups like this zod incident on daily.dev."}}]} ```