On: Zod 4.6.6 compromised by malware?

[xx_ns]

Interestingly, they added the `preinstall` key (that is supposed to run the malicious script when installed) under the package.json root, and not under `scripts`, so from what I can tell this wouldn't run on install.

Otherwise, yeah, this seems like a stage-1 loader for fetching and running a payload off the Ethereum mainnet.

[nicce → xx_ns]

Great reminder to always disable these scripts unless going through the hassle to verify if it does something absolutely useful.

[chrisweekly → nicce]

Use pnpm!

[madeofpalk → chrisweekly]

Every node package manager disables preinstall scripts by default now!

[nicce → madeofpalk]

You need to explicitly update npm to 12 before this is true in Node.

[ameliaquining → chrisweekly]

That's no longer necessary for security; npm doesn't run install scripts by default anymore.

[chrisweekly → ameliaquining]

Pnpm is still better in every way.

[nicce → ameliaquining]

Default npm version is still 11 on every Node install. Almost there, but not yet!

[ameliaquining → nicce]

Huh, I already got the new behavior last time I tried this, and I didn't manually enable it. I wonder why.

[nicce → ameliaquining]

You will get the warnings but default npm in Node will still run the scripts.

npm 12 has the relevant breaking changes: https://github.blog/changelog/2026-06-09-upcoming-breaking-c...

Node 27 will likely ship with it:

https://github.com/nodejs/Release/issues/1161

https://github.com/npm/cli/issues/9997