All flagged patterns are legitimate Zod internals: complex regex literals (email/IPv6/etc. with /� escapes), atob/btoa + fromCharCode for base64 checks, Function() references for ZodFunction/async detection, and ////// section comments. No data exfiltration, remote fetches, or harmful sinks present.
AI breakdown
Plain-English summary of what this package does and how it behaves.
zod is a TypeScript-first schema declaration and validation library with static type inference. It exports modules for schema compilation, validation, locales, and a mini variant via its main index.cjs entrypoint.
Capabilities
- Exports schema validation functions
- Includes compile and mini submodules
- Supports locales
- Runs build, test, and prepublish scripts
Data access
- None observed
Network
- No network access observed
The package declares no dependencies and shows no network or data access behavior. Static findings flag multiple obfuscated source files, which may require code review before use.
Security findings (22)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in src/v3/types.ts
Multiple obfuscation patterns in package/src/v3/types.ts
Multiple obfuscation patterns in src/v4/classic/schemas.ts
Multiple obfuscation patterns in package/src/v4/classic/schemas.ts
Multiple obfuscation patterns in src/v4/core/compile.ts
Multiple obfuscation patterns in package/src/v4/core/compile.ts
Multiple obfuscation patterns in src/v4/core/schemas.ts
Multiple obfuscation patterns in package/src/v4/core/schemas.ts
Multiple obfuscation patterns in src/v4/core/util.ts
Multiple obfuscation patterns in package/src/v4/core/util.ts
Multiple obfuscation patterns in v3/types.cjs
Multiple obfuscation patterns in package/v3/types.cjs
Multiple obfuscation patterns in v3/types.js
Multiple obfuscation patterns in package/v3/types.js
Multiple obfuscation patterns in v4/core/compile.cjs
Multiple obfuscation patterns in package/v4/core/compile.cjs
Multiple obfuscation patterns in v4/core/compile.js
Multiple obfuscation patterns in package/v4/core/compile.js
Multiple obfuscation patterns in v4/core/util.cjs
Multiple obfuscation patterns in package/v4/core/util.cjs
Multiple obfuscation patterns in v4/core/util.js
Multiple obfuscation patterns in package/v4/core/util.js
Package metadata
TypeScript-first schema declaration and validation library with static type inference
Files in package (500)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/zod