Zod 4.6.6 commit raises malware-injection questions
What happened
On October 12 a Hacker News post pointed to a Zod 4.6.6 commit that adds remote payload-loading code and asked whether the release was hit by malware. The post describes a new meta.test.mjs file and preinstall field in the zod and @zod/mini package config; the script queries an address list over Ethereum RPC, downloads a payload and dynamically executes Base64-encoded JavaScript. The post presents the code behavior in the commit and the question it raises. It does not conclude that malware injection is confirmed.
Written by AI from the coverage · updated 2 hours ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pageZod 4.6.6 compromised by malware?
Zod 4.6.6 的一份提交新增远程载荷加载代码，Hacker News 帖子据此提出遭恶意软件植入的疑问。zod 与 @zod/mini 的包配置新增 meta.test.mjs 文件和 preinstall 字段，脚本通过以太坊 RPC 查询地址列表，再下载载荷并动态执行 Base64 编码的 JavaScript。
Heat over time
Not enough continuous observations to draw a trend yet.