← Home

zod

npm Repository Homepage

TypeScript-first schema declaration and validation library with static type inference

68
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

colinhacks

Keywords

typescriptschemavalidationtypeinference

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-takeover AI (maintainer-change): colinhacks (Colin McDonnell) is the original Zod author; colinmcd94/vriad are his prior npm aliases. Account consolidation, not a hostile takeover. SLSA provenance confirms legitimate CI build. ai
provenance publisher-changed AI (provenance): Publisher change from colinmcd94 to colinhacks is the same person (Colin McDonnell) consolidating npm accounts. SLSA attestation corroborates legitimacy. ai
maintainer-change maintainer-added AI (maintainer-change): colinhacks is the original package author; addition reflects account consolidation, not a new third party. ai
maintainer-change maintainer-removed AI (maintainer-change): colinmcd94 and vriad are prior aliases of the same author (Colin McDonnell); removal is account consolidation. ai
source-diff large-new-source-files AI (source-diff): 231 new files reflect the v4 major release bundled alongside v3 compatibility layer. Files are readable TypeScript source and tests, not injected payloads. ai
source-diff source-size-tripled AI (source-diff): Size increase is explained by shipping both v3 and v4 codebases in one package. No obfuscated or minified code detected. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get() used in a lazy-initialization proxy pattern — standard JS idiom, not obfuscation. ai

Versions (showing 68 of 268)

Hide prereleases
Version Deps Published
4.2.0-canary.20251021T172355 0 / 0
4.2.0-canary.20251017T221623 0 / 0
4.2.0-canary.20251016T223057 0 / 0
4.2.0-canary.20251015T161525 0 / 0
4.2.0-canary.20251001T172710 0 / 0
4.2.0-canary.20250921T171445 0 / 0
4.2.0-canary.20250920T163917 0 / 0
4.2.0-canary.20250911T052041 0 / 0
4.2.0-canary.20250911T051520 0 / 0
4.2.0-canary.20250911T051312 0 / 0
4.2.0-canary.20250911T045937 0 / 0
4.2.0-canary.20250911T045735 0 / 0
4.2.0-canary.20250911T045022 0 / 0
4.2.0-canary.20250911T044631 0 / 0
4.2.0-canary.20250911T044505 0 / 0
4.2.0-canary.20250911T000242 0 / 0
4.2.0-canary.20250828T181323 0 / 0
4.2.0-canary.20250827T203557 0 / 0
4.2.0-canary.20250827T070334 0 / 0
4.2.0-canary.20250826T001214 0 / 0
4.2.0-canary.20250826T001136 0 / 0
4.2.0-canary.20250826T000512 0 / 0
4.2.0-canary.20250825T235836 0 / 0
4.2.0-canary.20250825T230433 0 / 0
4.2.0-canary.20250824T204911 0 / 0
4.1.13-beta.0 0 / 0
4.1.6-beta.1 0 / 0
4.1.6-beta.0 0 / 0
4.1.0-canary.20250823T071728 0 / 0
4.1.0-canary.20250823T071040 0 / 0
4.1.0-canary.20250823T064644 0 / 0
4.1.0-canary.20250821T014930 0 / 0
4.1.0-canary.20250821T014902 0 / 0
4.1.0-canary.20250813T051310 0 / 0
4.1.0-canary.20250806T002637 0 / 0
4.1.0-canary.20250806T000520 0 / 0
4.1.0-canary.20250804T184334 0 / 0
4.1.0-canary.20250804T184136 0 / 0
4.1.0-canary.20250730T094657 0 / 0
4.1.0-canary.20250730T051934 0 / 0
4.1.0-canary.20250729T081926 0 / 0
4.1.0-canary.20250729T053738 0 / 0
4.1.0-canary.20250729T053029 0 / 0
4.1.0-canary.20250729T005826 0 / 0
4.1.0-canary.20250725T001018 0 / 0
4.1.0-canary.20250724T211341 0 / 0
4.1.0-canary.20250723T222937 0 / 0
4.1.0-canary.20250723T221600 0 / 0
4.1.0-canary.20250723T215716 0 / 0
4.1.0-canary.20250723T214008 0 / 0
4.1.0-canary.20250711T201420 0 / 0
4.1.0-canary.20250711T200924 0 / 0
4.1.0-canary.20250711T052917 0 / 0
4.1.0-canary.20250710T223408 0 / 0
4.1.0-canary.20250710T200141 0 / 0
4.1.0-canary.20250710T005838 0 / 0
4.1.0-canary.20250710T002006 0 / 0
4.1.0-canary.20250709T185023 0 / 0
4.0.0-beta.20250709T182319 0 / 0
4.0.0-beta.20250505T195954 1 / 0
4.0.0-beta.20250505T012514 1 / 0
4.0.0-beta.20250505T001445 1 / 0
4.0.0-beta.20250505T001154 1 / 0
4.0.0-beta.20250504T224201 1 / 0
4.0.0-beta.20250504T215252 1 / 0
4.0.0-beta.20250503T014749 1 / 0
4.0.0-beta.20250430T185432 1 / 0
4.0.0-beta.20250424T163858 1 / 0

v4.2.0-canary.20251021T172355

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20251017T221623

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20251016T223057

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20251015T161525

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20251001T172710

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250921T171445

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250920T163917

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250911T052041

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250911T051520

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250911T051312

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250911T045937

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250911T045735

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250911T045022

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250911T044631

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250911T044505

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250911T000242

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250828T181323

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250827T203557

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250827T070334

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250826T001214

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250826T001136

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250826T000512

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250825T235836

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250825T230433

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.2.0-canary.20250824T204911

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.13-beta.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.1.6-beta.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.1.6-beta.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.1.0-canary.20250823T071728

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250823T071040

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250823T064644

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250821T014930

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250821T014902

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250813T051310

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250806T002637

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250806T000520

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250804T184334

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250804T184136

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250730T094657

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250730T051934

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250729T081926

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250729T053738

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250729T053029

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250729T005826

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250725T001018

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250724T211341

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250723T222937

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250723T221600

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250723T215716

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250723T214008

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250711T201420

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250711T200924

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250711T052917

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250710T223408

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250710T200141

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250710T005838

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250710T002006

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0-canary.20250709T185023

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.0.0-beta.20250709T182319

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0-beta.20250505T195954

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0-beta.20250505T012514

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0-beta.20250505T001445

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0-beta.20250505T001154

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0-beta.20250504T224201

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0-beta.20250504T215252

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0-beta.20250503T014749

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0-beta.20250430T185432

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0-beta.20250424T163858

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.