Hacker News Reader

Comment by Rapzid | Hacker News Reader

Viewed through the lens of Zod's responsibilities and processes I'd say a release was absolutely compromised. They cut and submitted a compromised release to npm; npm just happened to block the publishing.

View on HN

This is not the case. Zod's release CI was not triggerable via commits/tags by design. It used environment-scoped trusted publishing, which requires a GitHub token with elevated permissions. No releases of Zod or Standard Schema were sent to npm. Their security advisory is very misleading in this regard, which is why I tried to clarify the situation in my comment. [0]

[0] https://github.com/orgs/community/discussions/208477#discuss...

No it was never published. Only `nubjs/nub` was. You can read more on the write-up -> https://github.com/orgs/community/discussions/208477

nowhere in gp's comment do they claim it was published

The comment you replied to meant never submitted for publishing.

>They cut and submitted a compromised release to npm; npm just happened to block the publishing.

The point is that this is incorrect. A compromised release was not submitted to npm. It didn't make it beyond the git repo.

It claims a release was sent to NPM, and this is not true. The maintainer of Zod made sure even this kind of attack could not proceed with a publication. The comment I answered to is dismissing these efforts put in place by Colin.

Reply on news.ycombinator.com