Legitimate Zod v4 source. 'Function(' matches are from intentional new Function() codegen for fast schema parsers (compileFn / withParser). atob/btoa are used only for documented base64/JWT helpers. Unicode escapes and long slash comments appear only inside commented-out regex literals or section markers. No malicious behavior present.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Zod is a TypeScript-first schema declaration and validation library with static type inference. It ships compiled CommonJS modules for core validation, coercion, locales, and related utilities with no runtime dependencies.
Capabilities
- Schema validation and type inference
- Locale-specific error messages
- CommonJS module exports
- Build and test scripts defined
Data access
- None observed
Network
- No network access observed
Widely used legitimate validation library; static analysis flagged multiple files as obfuscated which may warrant review of the installed artifacts.
Security findings (22)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in v4/core/compile.cjs
Multiple obfuscation patterns in package/v4/core/compile.cjs
Multiple obfuscation patterns in v3/types.cjs
Multiple obfuscation patterns in package/v3/types.cjs
Multiple obfuscation patterns in v4/core/util.cjs
Multiple obfuscation patterns in package/v4/core/util.cjs
Multiple obfuscation patterns in v4/core/compile.js
Multiple obfuscation patterns in package/v4/core/compile.js
Multiple obfuscation patterns in v3/types.js
Multiple obfuscation patterns in package/v3/types.js
Multiple obfuscation patterns in v4/core/util.js
Multiple obfuscation patterns in package/v4/core/util.js
Multiple obfuscation patterns in src/v4/core/compile.ts
Multiple obfuscation patterns in package/src/v4/core/compile.ts
Multiple obfuscation patterns in src/v4/classic/schemas.ts
Multiple obfuscation patterns in package/src/v4/classic/schemas.ts
Multiple obfuscation patterns in src/v4/core/schemas.ts
Multiple obfuscation patterns in package/src/v4/core/schemas.ts
Multiple obfuscation patterns in src/v3/types.ts
Multiple obfuscation patterns in package/src/v3/types.ts
Multiple obfuscation patterns in src/v4/core/util.ts
Multiple obfuscation patterns in package/src/v4/core/util.ts
Package metadata
TypeScript-first schema declaration and validation library with static type inference
Files in package (500)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/zod