{
  "id": 13915060,
  "title": "Zod Got Backdoored. Your Lockfile Didn't Save You, Luck Did.",
  "url": "https://urgent.news/2026/10/12/zod-got-backdoored-your-lockfile-didnt-save-you-luck-did",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-12T09:02:34.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ashraf_chowdury09/zod-got-backdoored-your-lockfile-didnt-save-you-luck-did-e4l"
  },
  "original_language": "en",
  "account": "Malicious files appeared in test paths within the Zod and standard-schema TypeScript codebases, leading to a compromised version being pushed to GitHub. The attacker used Ethereum smart contracts to download and execute remote JavaScript. The malicious commit was reverted, and npm's preinstall scanning prevented the release of the compromised package. This incident highlights the importance of securing dependencies by disabling install scripts, maintaining fresh versions, adding cooldowns, and properly verifying and pinning lockfiles.",
  "summary": "Zod is in roughly every TypeScript codebase you've touched. Last weekend, \"Zod 4.6.6 compromised by malware?\" hit the front page of Hacker News. Here's what actually happened, and why the lucky ending shouldn't make you relax. TL;DR Malicious commits were pushed to colinhacks/zod on GitHub. Same pattern hit nubjs/nub and standard-schema/standard-schema . The payload was a remote loader that asks…",
  "key_points": [
    "Malicious files found in Zod and standard-schema codebases",
    "Ethereum smart contracts used for remote JavaScript execution",
    "npm's preinstall scanning prevented compromised package release"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}