Zod 4.6.6 Compromised: Blockchain-Powered Supply Chain Attack

If you use Zod in your TypeScript project, stop what you are doing and check your lockfile. Version 4.6.6 of Zod, and its sibling package @zod/mini, were compromised with injected malware that runs on install. The attack was discovered earlier today on Hacker News and traces back to a single malicious commit on the Zod GitHub repository [1].

Zod is one of the most widely adopted TypeScript validation libraries on npm, with millions of weekly downloads. It is a dependency in thousands of projects, including many production systems. A compromise of this scale is not a minor incident. It is a Category 5 supply chain event.

What the malicious code does

The attack is clever. The commit, titled "Fix bugs and improve performance," looks like a routine maintenance update. It bumps the version from 4.6.5 to 4.6.6, modifies the GitHub Actions release workflow to auto-publish on push to main, and adds a new file called meta.test.mjs to the package's published files list. It also adds a preinstall script to package.json that runs node meta.test.mjs when you install the package [2].

That file is the payload. Here is what it does, step by step:

• Queries Ethereum smart contracts. The script makes JSON-RPC calls to three public Ethereum nodes (LLamaRPC, PublicNode, and Cloudflare) using eth_call against a specific contract address. This retrieves data stored on-chain, which means the command and control infrastructure is decentralized and cannot be taken down by seizing a server [3].
• Decodes C2 server URLs from blockchain data. The response from the smart contract is hex-encoded data that gets decoded into a list of domain names. These are the command and control servers.
• Fetches and executes a payload. For each decoded URL, the script hits https://<domain>/loader and looks for a JSON response containing a base64-encoded setup script and a binary payload. If found, it writes the binary to a temp directory and executes the base64 script via import("data:text/javascript;base64,...").
• Cleans up. After execution, it deletes the temp directory. If anything fails, it calls process.exit(1), which would make the install appear to fail silently.

Why this is nasty

Three things make this attack particularly dangerous:

The C2 infrastructure is on a blockchain. Traditional malware uses hardcoded IP addresses or domain names that can be seized, blocked, or sinkholed. This payload fetches its command server list from an Ethereum smart contract. Law enforcement cannot serve a takedown notice to the Ethereum network. The contract address 0xe236330379d0c54aD5b2ef06aC714CEbdd4Ce523 is the single point of configuration, and it is immutable on-chain [4].

It runs at install time. The preinstall hook in npm executes before the package itself is installed. By the time your bundler resolves Zod and starts using it, the payload has already run. You do not need to import or call anything. Installing is enough.

The commit looks normal. "Fix bugs and improve performance" is the kind of commit message that shows up in every project every day. The version bump from 4.6.5 to 4.6.6 is a patch release, the kind most people auto-update to without thinking. The GitHub Actions change switches from manual approval to auto-publish on push, which means whoever pushed this commit also ensured it would reach npm without a human pressing the publish button [5].

The workflow change matters

The previous GitHub Actions configuration had a comment: "a version bump on main publishes nothing by itself; a maintainer runs gh workflow run release.yml and approves the npm environment." The malicious commit replaced that with automatic publishing on push to main when package.json changes.

This means the attacker did not just want to push code. They wanted to make sure the code shipped to npm without any further human intervention. The workflow change is the delivery mechanism. The meta.test.mjs file is the weapon. The preinstall hook is the trigger.

What you should do

If you have Zod 4.6.6 or @zod/mini 4.6.6 in your package-lock.json or pnpm-lock.yaml:

• Pin to 4.6.5 immediately. Add "zod": "4.6.5" to your package.json and reinstall.
• Check for the payload. Look for meta.test.mjs in node_modules/zod/. If it exists, you are affected.
• Audit your CI logs. If any CI pipeline installed 4.6.6, the preinstall script ran in that environment. Check for outbound connections to unknown domains, unexpected processes, or files in your temp directory.
• Rotate secrets. If your CI environment had access to deploy keys, npm tokens, or cloud credentials, rotate them. The payload downloads and executes arbitrary code, so you must assume everything in that environment is compromised.

If you are running Zod 4.6.5 or earlier, you are not affected by this specific attack. But you should still pin your versions and enable npm ci in your CI pipelines to prevent silent version bumps.

The bigger picture

This is not the first npm supply chain attack and it will not be the last. What makes it stand out is the sophistication of the C2 mechanism. Using Ethereum smart contracts to serve command server addresses is a technique borrowed from the cryptocurrency malware ecosystem, and it is appearing more frequently in general-purpose supply chain attacks [6].

The attack also highlights a structural problem with npm. The preinstall hook has been the vector for multiple supply chain attacks over the years, and there is still no widely adopted mechanism for preventing or even auditing arbitrary code execution during package installation. npm's own documentation warns about it, but the ecosystem relies on preinstall for legitimate build steps, so disabling it entirely breaks things.

The fix is not technical. It is procedural. Package maintainers need to treat their publish credentials like production secrets: hardware keys, mandatory 2FA, and no auto-publish workflows that trigger on every push to main. The Zod attacker exploited the fact that a single compromised token or collaborator account could push code and ship it to millions of users in one step [7].

As of this writing, the Zod repository shows the commit but it is unclear whether it has been reverted or whether 4.6.6 has been unpublished from npm. The Hacker News discussion is active and developers are reporting findings in real time [8].

If there is one lesson here, it is the one that keeps repeating: your dependencies are your attack surface. Every npm install is an act of trust. And trust, as the Zod community is learning today, can be broken by a single commit.