yuvalkarmi
Joined 10 years ago
Joined 10 years ago
On September 21, someone used Colin's git credentials to push this compromised code into the project, Colin caught it, and reverted it that same day (PR #6620). He subsequently did release 4.6.6 on October 11, but it did NOT contain the infected code.
Btw, Zod wasn't the only package targeted - same attack was attempted against standard-schema and nub. Nub DID make it to npm, but npm's malware scanning blocked it.
Looks like a legit (well, illegitimate) attempted supply-chain attack, but no actual Zod release was compromised.
Happiness depends on poorly-defined problems (relationships, meaning, values, identity).
Being good at solving structured problems doesn’t equal being good at navigating the messy, ambiguous ones that actually determine well-being.
Oh well