@valigo@ankkala the terrifying part to me was that there clearly were not enough tests to capture this bug. so it was a disaster waiting to happen to begin with.
LLMs expose gaps in your quality guards. hard and fast.
Ways to mitigate GitHub/npm supply chain attacks:
- Use pnpm
- Block all postinstall scripts unless necessary
- Use minimumReleaseAge
- Set up Trusted Publisher on npm/GitHub
- Disallow npm tokens
- Require 2FA for all org members
- Avoid pull_request_target
- If repo is public, consider restricting PRs to collaborators only
- Pin GitHub actions (peter-evans/create-pull-request@v8 → peter-evans/create-pull-request@5f6978f...)
with the soft-transition complete, I'm now recommending that ecosystem library authors support Zod 4 exclusively moving forward
👉 Zod 3 should be considered functionally EOL (last patch 10mo ago)
👉 Zod 4 is stable and no future major version is planned
https://t.co/VJxM78Qrv4