npmjs.com/package/zod · 4.6.7+s
87/ 100
Low riskLow risk: No code or behaviour findings were reported in this scan. Scanned 23 Oct 2026.
NetworkNone
No network calls
CodeNothing taken off
no code deduction
Score
87 / 1001000
Nothing was taken off for what the code did or what running it showed.
What it did
33 events in 21.2sFetched0.2s
1141941 bytes
Checked0.5s
0 locked dependencies, 0 malicious
Jev17.4s
Answered questions from the evidence
Sandbox17.4s
install completed, entry completed, 0 forged call(s)
Score18.1s
87 Low risk
Luna's report
This result was Low risk. Pin the scanned version. Behaviour outside the observed install and entry windows was not verified.
We installed the package and ran its entry point in a throwaway sandbox, and scanned the reachable code. The run completed; no behaviour findings were reported.
What it ran
Installednpm · 1 package · 3.0s
Entry pointenv -i HOME=/hom…T=1 FAKETIME_NO_CAC
NetworkNo calls
MachineDestroyed after the scan
Jev's answers
answered from the evidenceDocs check
The docs do not say it makes no network calls
The docs do not say it has no side effects
Show all 3 answers
What it did fits what its docs say it is for
Install check
Install-time code does not use the network
Install-time code does not read credentials
Show all 5 answers
Install-time code does not run other programs or payloads
Install-time code is not obfuscated
Jev judged this code harmless
package.jsonNot verified
Behaviour outside the observed install and entry windows
Code paths not triggered by install or the entry point
Show all 3 items
Payloads gated on calendar dates past the accelerated clock window, or on hosts that need real responses
Reputation
npmWeekly npm downloads: 207048213
npmFirst npm publish: 2420 days ago
npmNo maintainer change within 30 days
npmFirst published 6 years ago
npmnpm maintainers: colinhacks
npm207M weekly downloads
Shown apart from the code and behaviour findings.