Security1 hOctober 12, 2026, 16:02

Zod repo backdoored: malicious commits blocked before reaching npm

Malicious commits were pushed to colinhacks/zod on GitHub, carrying a loader that queried an Ethereum smart contract for its next-stage download location. Per GitHub's advisory, npm's publish-time scanning blocked the one submitted malicious version, @nubjs/nub@0.9.4, while the zod and standard-schema changes never reached the registry.

DEV Community

Open source

Zod repo backdoored: malicious commits blocked before reaching npm

Malicious files hid in test paths: packages/zod/meta.test.mjs and packages/mini/meta.test.mjs
Loader used preinstall/postinstall hooks and read a delivery address from an Ethereum contract
npm blocked @nubjs/nub@0.9.4 at publish time; zod and standard-schema changes were never published
Payload SHA-256: 5ed518aaff5aebc729545b8eb223ec31927cd1bfa53169517f09cdbcc9fd5a0b

#Zod#Npm#GitHub

FakeGit malware campaign returns with 17,610 malicious GitHub repos

Security

GitHub lost 3,800 repos after malicious VSCode extension

Security

CrowdSec: TanStack npm Attack Led to Copy of 170 Private GitHub Repos

Security

Zod repo backdoored: malicious commits blocked before reaching npm

FakeGit malware campaign returns with 17,610 malicious GitHub repos

GitHub lost 3,800 repos after malicious VSCode extension

CrowdSec: TanStack npm Attack Led to Copy of 170 Private GitHub Repos

LiteLLM supply chain backdoor: malicious 1.82.7 and 1.82.8 on PyPI