GoKawiilSuspicious code resembling malware found in Zod 4.6.6 package
A version of the popular Zod validation library, 4.6.6, has surfaced containing obfuscated JavaScript that fetches remote instructions via blockchain RPC calls and downloads a secondary payload to execute. The code queries multiple Ethereum nodes, decodes the response into a domain, then retrieves a loader script that writes and runs an additional file in a temporary directory before cleaning up traces.