A recent change in the zod repository upgrades package versions to 4.6.6 and injects a new file meta.test.mjs into both @zod/mini and zod packages, then adds a "preinstall": "node meta.test.mjs" hook to package.json and includes that file in published files. The release workflow and version constant were updated to publish 4.6.6. The patch modifies nine files (including pnpm lock updates) and explicitly makes the meta.test.mjs part of the package payload that runs during npm install.
The injected meta.test.mjs contains obfuscated code that queries multiple Ethereum RPC endpoints using eth_call against a hardcoded contract/address and calldata, decodes results into domain names, fetches a JSON "loader" from those domains, writes a payload file to a temporary directory, sets RUNTIME_DIR, and executes a base64-encoded setup via dynamic import("data:text/javascript;base64,..."), then attempts to remove the temp files. This sequence results in remote code execution during npm install and persistent runtime setup. Do not install version 4.6.6; treat any installs of 4.6.6 as compromised and revert to a prior safe version until the repository is audited and the malicious preinstall removed.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
UK Prime Minister Andy Burnham admitted that Russia was involved in influencing Britain's 2016 Brexit referendum. This marks the first official acknowledgment by a British leader of Russia's role in the divisive vote to leave the EU. (kyivindependent.com)
Deloitte helped falsify documents to hide Roman Abramovich's assets and evade taxes, with accounts in Cyprus omitting assets worth $672 million. Experts describe the scheme as blatant tax evasion, which Abramovich denies knowing about or authorizing. (bbc.com)
Ledger confirmed the presence of an unauthorized hardware implant inside a customer's crypto wallet during an investigation into thefts linked to CryptoBilis. The company has suspended sales of all hardware wallets and is working with authorities to determine if the implant caused the estimated $92.9 million in losses. (crypto.news)
Fable's AI technology played a role in replacing experienced engineers, fueling fears of job loss in the tech industry. Personal experiences highlight the emotional and professional impact of layoffs influenced by AI advancements. (cendyne.dev)
TorrentClaw is an AI-powered torrent search engine that verifies torrent contents with its TrueSpec feature to identify fakes and malware. TrueSpec analyzes files and scans suspicious content with VirusTotal to enhance safety for users. (torrentfreak.com)
PostgreSQL's performance issues at scale are often caused by storage limitations rather than the database itself. Using local NVMe storage can significantly improve PostgreSQL performance in production environments. (clickhouse.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.