Zod's 21 September malicious commits were reverted the same day. npm 4.6.6 is clean.

On 21 September 2026 two commits titled “Fix bugs and improve performance” landed on the Zod git repository. Both were reverted the same day. The packages npm published as [email protected] and @zod/[email protected] on 11 October do not contain the added files. This is a near miss in git history. It is not a malicious copy of the published 4.6.6 packages.

What landed, and what came out

The first commit, d821685, is timestamped 2026-09-21T11:56:52Z. It adds packages/zod/meta.test.mjs and packages/mini/meta.test.mjs, lists the zod copy in that package’s files array, and sets a preinstall value of node meta.test.mjs. In both package manifests the key sits at the root, beside main, not inside scripts. The added file names public Ethereum RPC hosts: eth.llamarpc.com, ethereum-rpc.publicnode.com, and cloudflare-eth.com. The file is not reprinted here. The commit metadata records the author name colinhacks.

Seven minutes later, ce1e11b (12:03:30Z) renames those files to meta.mjs. The same first commit also changes .github/workflows/release.yml so a push to main that touches the package manifests starts the release workflow. That trigger change is part of what the cleanup removes.

Pull request 6620, “Cleanup bad commits,” was opened and merged at 21:33 UTC on 21 September. Commit 10dda3a reverts both “Fix bugs and improve performance” commits. It also reverts other commits from the same stretch, including one whose message is “ci: drop the npm environment approval gate from publish.” The cleanup commit is authored as Colin McDonnell and committed through GitHub.

The v4.6.6 GitHub release, published 2026-10-11T16:19:03Z, still lists the bad commits in its history, because a revert does not delete them from the log. The release target is commit 284243fb, which is also the gitHead on the npm metadata for both packages.

The published tarballs

A download on 12 October of the registry tarballs found no meta.test.mjs, no meta.mjs by that loader name, and no preinstall key at the package root or under scripts. Registry time fields put [email protected] at 2026-10-11T16:18:23.878Z and @zod/[email protected] at 2026-10-11T16:18:21.505Z. The packuments list no 4.6.7 and no 4.6.8. Latest for both names is 4.6.6. The downloaded archives match the registry shasum and integrity values. No install was run.

The Hacker News thread is titled “Zod 4.6.6 compromised by malware?” Commenter xx_ns writes that the preinstall key was added at the package.json root rather than under scripts, and concludes it would not have run on install. npm’s scripts documentation describes preinstall as a lifecycle script in the scripts field. The September commit placed the key outside that field. That supports the commenter’s reading of a manifest that never shipped. It does not make the git commits benign.

Libraries that declare Zod

Zod shows up as a dependency of JavaScript agent libraries. Checked on the npm registry on 12 October: @modelcontextprotocol/sdk 1.32.1 depends on zod at ^3.25 || ^4.0. The ai package 7.0.137, openai 7.32.0, and @anthropic-ai/sdk 0.133.0 declare zod as a peer dependency (ai also pins a 3.x Zod in devDependencies). A peer dependency means the application supplies Zod. It does not mean those packages published the 21 September files. For a case where a published npm release did carry a malicious install script, see tensorlake 0.5.144.

Staged publishing after the revert

Pull request 6622, merged 24 September, says CI can no longer publish. Both publish steps become npm stage publish, so a version sits in npm’s staged queue until a maintainer approves it with 2FA. Pull request 6638, merged 30 September, holds the release run on a release-approval environment until the staged versions are approved. Both commits appear in the v4.6.6 release notes.

Someone who installed zod or @zod/mini at 4.6.6 from npm after 11 October got the tarballs checked here, which do not include the loader. Someone who built the git tree at either bad commit on 21 September was on the revision reverted that evening, not on the package npm later published.