Zod 4.6.6 compromised by malware?

New code in Zod 4.6.6 attempts to execute remote scripts, introducing a potential security risk to projects using the library.

The Zod JavaScript library has released version 4.6.6, with updates to its `mini` and `zod` packages. These updates include changes to the `package.json` and `jsr.json` files for both packages, indicating minor version increments from 4.6.5 to 4.6.6. Additionally, new files named `meta.test.mjs` have been introduced into both the `mini` and `zod` packages. These new files contain code that attempts to fetch and execute JavaScript from remote Ethereum RPC endpoints, a behavior that has raised concerns about potential malware or malicious code injection within the Zod library.

The introduction of `meta.test.mjs` files in Zod 4.6.6, which dynamically fetch and execute code from Ethereum RPC endpoints, represents a significant departure from typical library behavior. This mechanism suggests a sophisticated attempt to disguise or deliver potentially malicious payloads, exploiting the trust developers place in popular utility libraries. The use of `preinstall` scripts in `package.json` further exacerbates this risk, as the malicious code could execute during the installation process before any security review.

This event highlights a growing trend of supply chain attacks targeting the JavaScript ecosystem, where even widely-used and trusted packages can become vectors for distributing malware. Developers and organizations relying on Zod, or any dependency, must now critically evaluate their installation and runtime security practices. Future Zod releases will be scrutinized for similar obfuscation techniques, and the broader community will likely increase demand for verifiable build processes and runtime security tools for npm packages.