Zod 4.6.6 is safe — the backdoor hit the repo, never npm
A stolen git-push credential planted a blockchain-controlled loader in zod's source. Trusted publishing stopped it reaching npm — audit your install scripts.
Copy markdown
Your zod install is clean
The viral panic overstates it: malicious commits landed in the zod and standard-schema repos on Sept 21, but trusted publishing kept them out of npm. zod 4.6.6 (shipped Oct 11) is unaffected, and the one package that reached npm's pipeline — @nubjs/nub@0.9.4 — was auto-flagged High risk and blocked within minutes.
The attack: a C2 address hidden on-chain
The planted preinstall.js called an Ethereum smart contract via eth_call to resolve a throwaway domain, downloaded a loader, ran it with your install's permissions, then deleted the evidence. On-chain C2 is near-impossible to take down. Practical defense: install with --ignore-scripts and audit the preinstall/postinstall hooks in your dependency tree.
Why trusted publishing saved zod
The entry point was a stolen git push credential — not an npm or GitHub token. Because zod releases through npm trusted publishing (OIDC) and a locked GitHub deployment environment, that credential couldn't ship a package. If you maintain anything on npm, this is the migration to prioritize: it turned a repo breach into a non-event.