Zod, a 346-million-download npm package, had malware in its git history
A reverted commit from a compromised git credential sat visible in zod's GitHub history for three weeks before a developer auditing the code flagged it.
On 21 September, someone with a compromised git push credential, not an npm or GitHub token, pushed a malicious commit straight to the main branch of zod, the TypeScript validation library. The same credential also hit standard-schema and nub. The commit, disguised with a message like “Fix bugs and improve performance”, ran on install, queried an Ethereum smart contract for a delivery address, and fetched a second-stage payload from there. npm’s publish-time scanning caught the nub version and blocked it before it went live. The zod and standard-schema commits were reverted before their packages were ever published, so the malicious code never reached npm.
That should have been the end of it, but reverted commits stay in git history. On 11 October, a developer auditing zod before upgrading found the commit still sitting under the tag for v4.6.6 and opened GitHub issue #6658. Maintainers confirmed the next day that the code was caught by pull request #6620 and never shipped: the published npm tarball is clean. Zod pulls roughly 346 million downloads a week, according to npm’s own registry API, so the scare reached a lot of inboxes fast.
Why it matters: if your supply-chain tooling scans a dependency’s git history rather than its published tarball, you will keep tripping over this commit. Checking what npm install actually pulls down, not the full commit log, is the thing that tells you whether you’re exposed. Maintainer colinhacks has since moved zod’s publishing to environment-scoped, 2FA-gated staged releases, which is the control that would have stopped the push credential from mattering in the first place.