Executive Summary
On September 21, 2026, a coordinated attack targeted three public repositories—`colinhacks/zod`, `nubjs/nub`, and `standard-schema/standard-schema`—adding a malicious loader disguised as performance improvements. The loader utilized npm's `preinstall` and `postinstall` hooks to query public Ethereum RPC services, retrieve a delivery location from a smart contract, and execute remotely hosted JavaScript. This multi-repository attempt signifies a shift toward targeting release pipelines rather than code review processes.
While the malicious commits were successfully pushed to all three repositories due to compromised credentials, impact was severely limited. Hardened release workflows prevented the `zod` and `standard-schema` changes from ever reaching the npm registry. The one version that did reach the publishing pipeline, `@nubjs/nub@0.9.4`, was intercepted by npm’s publish-time malware scanning within nine minutes of the commit. GitHub’s subsequent advisory confirmed zero evidence of downstream execution, marking a high-profile success for registry-level preventive scanning.
This incident highlights a major trend in supply chain tradecraft: the use of 'dead-drop' loaders where the package itself contains only a downloader, allowing attackers to rotate the final payload via smart contracts without updating the package version. Organizations must prioritize hardening their CI/CD pipelines and strictly monitoring or disabling lifecycle scripts in sensitive development environments.