Zod 4.6.6 malware alarm: the bad commit never reached npm

Zod 4.6.6, the newest release of the popular TypeScript validation library, shipped on October 11, 2026. Its release page lists commits from a malware attack, and developers raised the alarm on GitHub and Hacker News. Those commits were pushed on September 21 and reverted the same day. According to GitHub's security advisory, the malicious Zod changes never reached npm, the registry where JavaScript packages are published.

Zod checks that data, such as a form or an API response, has the shape a program expects. Many TypeScript projects depend on it.

Why Zod 4.6.6 looked infected

The 4.6.6 release page lists every commit since the previous release, 4.6.5. That list includes two commits titled "Fix bugs and improve performance" and version bumps named "4.6.7" and "4.6.8". It also includes two changes to the publishing setup: "ci: publish to npm with NPM_TOKEN" and "ci: drop the npm environment approval gate from publish".

A GitHub issue titled "Suspicious preinstall script in v4.6.6 commit history" flagged the first of those commits. A Hacker News thread asked "Zod 4.6.6 compromised by malware?" The issue's author added a caution:

The change appears to have been reverted before the final release, and the suspicious files don't seem to be present in the npm-published version of 4.6.6.

The same list also includes "Cleanup bad commits (#6620)", the change that removed them.

What the September 21 attack did

GitHub's advisory gives the timeline. The same loader reached three projects within an hour.

Time (UTC)	Repository	What happened
11:56	colinhacks/zod	Commit d821685, "Fix bugs and improve performance"
12:37	standard-schema/standard-schema	Commit with the same title and loader
12:54	nubjs/nub	Commit with the same title and loader
13:00	nubjs/nub	Follow-up, "chore: update npm/nub package"
13:09	npm	Scan of @nubjs/nub@0.9.4 logged; the version was blocked

The Zod commit added two four-line files named meta.test.mjs, one in the main package and one in Zod Mini. Despite the name, they are not tests. The commit also added a preinstall entry to run them. That is an install hook: code that runs when a package is installed. It bumped the version to 4.6.6 and changed the release workflow so a push to the main branch would start a publish.

The loader asks a smart contract, a small program stored on the Ethereum blockchain, for a web address. It then downloads JavaScript from that address, runs it with the installing user's permissions and deletes its temporary files. Because the address comes from the blockchain, the code in the repository never shows where the payload lives. The MALFEX npm malware reported this month uses a similar trick with Solana.

Why nothing reached npm

The maintainer, colinhacks on GitHub, wrote in the advisory thread: "Seems like a git push credential of some kind was compromised, not an npm or GitHub token." The maintainer also wrote: "The attack consisted of malicious commits and tagged pushes to main."

Other commits that day tried to force a release. They removed the approval step, added a publish path using an NPM_TOKEN secret and bumped the version twice. According to the maintainer, Zod's release flow had not been open to this kind of attack since npm removed token-based publishing last December. The advisory states that the Zod and standard-schema changes "did not reach npm publishing."

Nub was different. Its release could be started by creating a tag, so @nubjs/nub@0.9.4 reached npm's publishing pipeline. The registry held the version for checks, found the malicious code and blocked it before anyone could install it.

Pull request #6620, "Cleanup bad commits", reverted six commits and was merged on September 21. It deleted the attacker's new publish workflow and the loader files, removed the preinstall entries and set the version back to 4.6.5.

How Zod 4.6.6 was published

According to its npm registry entry, 4.6.6 was published by GitHub Actions through trusted publishing and approved by colinhacks. Trusted publishing lets npm accept a release only from a named GitHub workflow, so there is no long-lived token to steal. Earlier this month, npm let trusted publishing move dist-tags such as latest. The package carries a provenance attestation, a signed record of where it was built. Its manifest lists no preinstall, install or postinstall script.

The release also tightens the process. Two of its changes, #6622 and #6638, stage new npm versions instead of publishing them and hold each run until those versions are approved. On September 24, the maintainer wrote that all of their npm packages now use staged publishing that can only be started by hand.

How the push credential was taken is still under investigation with GitHub, the maintainer said.

What this means for developers

• No sign of malware in Zod 4.6.6 from npm. Its manifest has no install hook, and it carries provenance. npm view zod@4.6.6 scripts shows the scripts without installing anything.
• Search logs for the delivery domain. The advisory lists dsakldjklsaj33112[.]com as an indicator. Check machines that built Zod, standard-schema or nub from Git source on September 21. Remove the brackets when searching.
• Turn off install scripts where you can. This attack depended on a preinstall hook. npm's ignore-scripts setting stops those hooks from running. Test that the project still builds, since some packages need their scripts.
• Maintainers can copy Zod's setup. The attacker could push to main and edit the workflow, yet still could not publish Zod. Trusted publishing plus a manual approval step held. A release that starts on a tag, as nub's did, is the weaker design.