The colinhacks/zod repository released version 4.6.6 for both @zod/zod and @zod/mini packages, updating workflow triggers to publish on pushes to main when package.json files change. The release includes a workflow_dispatch trigger for manual releases and bumps the version from 4.6.5 to 4.6.6. Notable additions include a new preinstall script running meta.test.mjs and updated exports configuration.
However, the diff reveals a concerning code injection involving encrypted strings, external RPC calls to Ethereum nodes, and dynamic payload execution that writes and imports base64-encoded modules into a temporary directory before cleanup. This behavior appears unrelated to Zod’s core functionality and raises security concerns despite being embedded in package.json and source files. The changes suggest a potential supply chain compromise disguised as a version bump.
Source: Hacker News · Summarized by HeadlinesBriefing