Zod 4.6.6 compromised by malware?(github.com) |
Zod 4.6.6 compromised by malware?(github.com) |
On September 21, someone used Colin's git credentials to push this compromised code into the project, Colin caught it, and reverted it that same day (PR #6620). He subsequently did release 4.6.6 on October 11, but it did NOT contain the infected code.
Btw, Zod wasn't the only package targeted - same attack was attempted against standard-schema and nub. Nub DID make it to npm, but npm's malware scanning blocked it.
Looks like a legit (well, illegitimate) attempted supply-chain attack, but no actual Zod release was compromised.
The malware seems to inject some JS payload to execute when zod is installed, by fetching it from an ethereum smart contract (if I understand it correctly).
Don't forget to flag the version on npm.
EDIT: looks like the update never got on NPM: https://news.ycombinator.com/item?id=50053253
I didn't study what packages/mini/meta.test.mjs is doing in particular but it's not looking great
const R=["https://eth.llamarpc.com","https://ethereum-rpc.publicnode.com","https://cloudflare-eth.com"]https://github.com/colinhacks/zod/commit/10dda3a3a4bc76ed0bf...
Otherwise, yeah, this seems like a stage-1 loader for fetching and running a payload off the Ethereum mainnet.
name checks out
I feel like they could have done a better job here. Having just a few changes, one of which is a huge blob of blatantly compromising code, is just too obvious.
The URLs are interesting, I don't do anything in this area but I didn't know that you could use the blockchains to hide your command and control URL, in a way that allows you to remotely update the URL whenever you want. It turns out there is a use for blockchain! Making control URLs immune to takedowns!
> Seems like a git push credential of some kind was compromised, not an npm or GitHub token. Still working with the GitHub team to get some better forensics on what/how. The attack consisted of malicious commits and tagged pushes to main.
So it didn't go through review, it was pushed straight to main. It also seems their publishing pipeline was already secured against this sort of thing:
> Zod's release flow was already secured against kind of attack via trusted publishing and a dedicated GitHub environment for secure deployments. Zod's release CI worked as designed and was already secure against this; NPM's malware scanning didn't prevent any malicious here.
Just pasted the code into claude to try and decipher the minified js and looks like it tries to find the server via the blockchain? and then download further stuff from there.
It definitely doesn't inspire confidence in the project taking security seriously.
(Also the "write-up" is almost surely a "Claude-up", though it appears generated by someone external to the project).
>They cut and submitted a compromised release to npm; npm just happened to block the publishing.
The point is that this is incorrect. A compromised release was not submitted to npm. It didn't make it beyond the git repo.