- Published on
Zod 4.6.6 compromised by malware?
- Authors
- Name
- DeepHorus
Security researchers are examining Zod 4.6.6 after an obfuscated loader script surfaced in connection with the popular TypeScript validation library. The code does not resemble normal package logic, instead behaving like a staged malware downloader. If confirmed, it would represent another supply-chain compromise affecting a widely used open-source dependency.
The snippet opens by sending JSON-RPC eth_call requests to a list of blockchain endpoints. Each call targets a fixed contract address with encoded data, and the returned hex result is decoded into plain domain names. Every decoded domain is then contacted at a "/loader" path.
A valid response must supply three base64 fields: setupB64, payloadName and payloadB64. The script decodes payloadB64 and writes it into a fresh temporary directory created with mkdtempSync. The setupB64 value is then executed through a dynamic import of a data: URL.
Before running, the loader stores the temporary path in process.env.RUNTIME_DIR and later touches globalThis.SETUP_DONE. Once the import settles, the directory is removed recursively using rmSync. Any unhandled error silently terminates the process with exit code 1.
Retrieving command-and-control addresses through eth_call is an established evasion technique. Blockchain state is immutable and difficult to seize or sinkhole, unlike a conventional domain. Requesting the "latest" block keeps the resolution dynamic, allowing operators to rotate infrastructure.
Zod is depended upon by thousands of projects, making any tampering with it high-impact. Developers are advised to verify installed versions, review lockfiles and audit recent dependency updates. Automated scanners should flag outbound blockchain RPC traffic from build and runtime environments.
No official statement has been issued by the maintainers regarding version 4.6.6. The investigation remains ongoing. Users are urged to treat unverified versions with caution until a clean release is confirmed.
