zod — Greenflagged

TypeScript-first schema declaration and validation library with static type inference

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

colinhacks

typescriptschemavalidationtypeinference

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
maintainer-change	maintainer-takeover	AI (maintainer-change): colinhacks (Colin McDonnell) is the original Zod author; colinmcd94/vriad are his prior npm aliases. Account consolidation, not a hostile takeover. SLSA provenance confirms legitimate CI build.	ai	2026/04/22
provenance	publisher-changed	AI (provenance): Publisher change from colinmcd94 to colinhacks is the same person (Colin McDonnell) consolidating npm accounts. SLSA attestation corroborates legitimacy.	ai	2026/04/22
maintainer-change	maintainer-added	AI (maintainer-change): colinhacks is the original package author; addition reflects account consolidation, not a new third party.	ai	2026/04/22
maintainer-change	maintainer-removed	AI (maintainer-change): colinmcd94 and vriad are prior aliases of the same author (Colin McDonnell); removal is account consolidation.	ai	2026/04/22
source-diff	large-new-source-files	AI (source-diff): 231 new files reflect the v4 major release bundled alongside v3 compatibility layer. Files are readable TypeScript source and tests, not injected payloads.	ai	2026/04/22
source-diff	source-size-tripled	AI (source-diff): Size increase is explained by shipping both v3 and v4 codebases in one package. No obfuscated or minified code detected.	ai	2026/04/22
semgrep	semgrep:api-obfuscation-reflect	AI (semgrep): Reflect.get() used in a lazy-initialization proxy pattern — standard JS idiom, not obfuscation.	ai	2026/04/21

Show 131 prereleases