All flagged patterns are benign: atob/btoa + fromCharCode are used only for legitimate JWT header decoding (isValidJWT) and base64 <-> Uint8Array codec helpers in v4; unicode escapes and long slash comments appear only inside commented-out legacy regexes or as section markers. No remote execution, data exfiltration, or hidden payloads.
AI breakdown
Plain-English summary of what this package does and how it behaves.
zod is a TypeScript-first schema declaration and validation library with static type inference. It ships as CommonJS modules with core validation, coercion, error handling, and locale support.
Capabilities
- Runs postbuild script
- Runs prepublishOnly script
- Includes built CommonJS modules for v3/v4 core, checks, locales, and compat
Data access
- None observed
Network
- No network access observed
Package has no runtime dependencies but multiple files are flagged as obfuscated; review build artifacts before use in sensitive environments.
Security findings (16)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in v3/types.cjs
Multiple obfuscation patterns in package/v3/types.cjs
Multiple obfuscation patterns in v4/core/util.cjs
Multiple obfuscation patterns in package/v4/core/util.cjs
Multiple obfuscation patterns in v3/types.js
Multiple obfuscation patterns in package/v3/types.js
Multiple obfuscation patterns in v4/core/util.js
Multiple obfuscation patterns in package/v4/core/util.js
Multiple obfuscation patterns in src/v4/classic/schemas.ts
Multiple obfuscation patterns in package/src/v4/classic/schemas.ts
Multiple obfuscation patterns in src/v4/core/schemas.ts
Multiple obfuscation patterns in package/src/v4/core/schemas.ts
Multiple obfuscation patterns in src/v3/types.ts
Multiple obfuscation patterns in package/src/v3/types.ts
Multiple obfuscation patterns in src/v4/core/util.ts
Multiple obfuscation patterns in package/src/v4/core/util.ts
Package metadata
TypeScript-first schema declaration and validation library with static type inference
Files in package (500)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/zod