Zod Got Backdoored. Your Lockfile Didn't Save You, Luck Did.
Zod is in roughly every TypeScript codebase you've touched. Last weekend, "Zod 4.6.6 compromised by malware?" hit the front page of Hacker News. Here's what actually happened, and why the lucky ending shouldn't make you relax. TL;DR Malicious commits were pushed to colinhacks/zod on GitHub. Same pattern hit nubjs/nub and standard-schema/standard-schema . The payload was a remote loader that asks…
Malicious files appeared in test paths within the Zod and standard-schema TypeScript codebases, leading to a compromised version being pushed to GitHub. The attacker used Ethereum smart contracts to download and execute remote JavaScript. The malicious commit was reverted, and npm's preinstall scanning prevented the release of the compromised package.
This incident highlights the importance of securing dependencies by disabling install scripts, maintaining fresh versions, adding cooldowns, and properly verifying and pinning lockfiles.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
