Malicious Code Injected into Zod Validation Library
AI-generated image · Bay Street Wire
A commit to the Zod repository introduced a hidden 'meta.test.mjs' file that executes remote payloads via Ethereum RPC calls.
A security breach has hit the Zod validation library, a critical tool for type-safety in TypeScript applications. As first reported on Hacker News, a commit in the colinhacks/zod repository authored by Colin McDonnell introduced a malicious update that added a file named `meta.test.mjs` into both the `@zod/zod` and `@zod/mini` packages.
The commit, labeled as a fix for bugs and performance improvements, modified `package.json` to include a `preinstall` script that triggers the execution of `meta.test.mjs`.
Analysis of the `meta.test.mjs` code reveals a sophisticated delivery mechanism. The script targets multiple Ethereum RPC endpoints—including `https://eth.llamarpc.com`, `https://ethereum-rpc.publicnode.com`, and `https://cloudflare-eth.com`—to perform an `eth_call` to a specific contract address (`0xe236330379d0c54aD5b2ef06aC714CEbdd4Ce523`). The response from these calls is decoded to identify a remote URL. The script then fetches a JSON payload from that URL, writes a file to a temporary directory using `fs.mkdtempSync`, and executes the payload via a base64-encoded JavaScript import.
The breach also included changes to the `.github/workflows/release.yml` file, which updated the release process to trigger on pushes to the `main` branch specifically when `package.json` files in the `packages/zod` or `packages/mini` directories are modified. The affected versions identified in the `jsr.json` and `package.json` files are 4.6.6.