Pimp My IDE / garage dispatchBack to the garage
October 12, 2026 / package custody / incident reading

Read the package, not the panic.

A malicious commit can appear in a release history without landing in the registry archive. Trace each handoff before you say what shipped.

The commit was bad. The inspected 4.6.6 archive did not contain its install hook.

The scary diff is real.

On September 21, a commit in the Zod repository added a preinstall hook to the package manifest. The added script queried public Ethereum services, fetched a second location, downloaded more code, and tried to execute it during installation.[1]

GitHub's npm incident note calls the loader malicious. It says the related Zod changes did not reach npm publishing. The repository removed the bad changes later that day.[2]

A red commit proves a red commit. It does not identify the bytes a registry served three weeks later.

The tag contains history, not every old file.

Hacker News resurfaced the malicious commit after Zod 4.6.6 shipped. The release page lists that commit in the version's history. It also lists the cleanup commit that reverted it before the tagged release tip.[3]

That is why a release note can mention a malicious ancestor while the final tree excludes the malicious file. A commit list answers what happened on the branch. The tag answers which tree the release names. The registry archive answers which bytes the package manager can download.

The archive is the installable object.

At 09:04 UTC on October 12, the npm registry named 4.6.6 as Zod's latest version. We fetched the versioned archive once without installing it. The file measured 1,141,937 bytes, contained 840 entries, and had SHA-256 312553620ac82cbb25d505100fbb41c1e219b3cd6979cf93c3a1b4dd5b79e039.[4]

The archive's package manifest identified version 4.6.6. It had no preinstall script. Its member list had no meta.test.mjs. Those checks address the loader shown in the September commit. They do not prove that every file in the package is safe or that the package behaves correctly.

Provenance is a route, not a verdict.

The registry metadata links 4.6.6 to an npm provenance attestation. npm says provenance can establish where and how a package was built. npm also says the attestation does not guarantee that a package has no malicious code.[5]

Keep both facts. The attestation helps connect the archive to a build route. The archive inspection checks the exact bytes for the reported loader. Neither replaces code review, runtime tests, or a release decision.

The sight glass below turns those records into one release note. It does not install Zod, run its code, verify every archive member, or approve the version.

Interactive makeover / one version badge replaced with four evidence windows

Open the sight glass.

A normal package badge hides the route between source and installable bytes. This control lets you inspect one record at a time while one copyable receipt keeps their limits together.

CommitCleanupTagArchive

Evidence selector

Use the native radio controls. Each detent changes the inspection window and the receipt. Selecting a record does not approve the release.

Choose one record
Selected record / evidence, not approval
Archive inspected

The reported loader is absent.

The versioned archive has no preinstall script and no meta.test.mjs member. Runtime behavior remains untested.

Sources read / October 12, 2026

Source log

Open the evidence route
  1. Zod commit d821685, committed September 21, 2026. The diff adds meta.test.mjs, adds a preinstall hook, and changes the release workflow. This is evidence of the repository change, not evidence that npm served it.
  2. GitHub Community npm incident note 208477, published September 21 and read October 12, 2026. It documents the loader, states that the Zod changes did not reach npm publishing, and includes the Zod maintainer's narrower account of the release controls.
  3. Zod release v4.6.6 and the GitHub tags API, read October 12, 2026. The tag resolves to commit 284243fb0d6532665afdc9239188773bb624f73c. The release history lists both the malicious commit and cleanup commit 10dda3a. Hacker News item 50052814 was the discovery route.
  4. npm registry record for Zod and the versioned Zod 4.6.6 archive, fetched October 12, 2026. The archive was downloaded once, listed, and removed without installation. The byte size, member count, package version, script field, member names, and SHA-256 in this article come from that one file.
  5. npm lifecycle script documentation and npm provenance documentation, read October 12, 2026. npm documents that preinstall runs during npm install and npm ci. It also states that provenance links a package to source and build instructions but does not guarantee an absence of malicious code.

Artifact boundary: the exact archive was not installed or executed. Listing the archive and reading its package manifest support the narrow statements above. They do not prove runtime behavior, full package safety, or suitability for any project.