Might is pretty tame, it is infected - EDIT: title was changed, it said "might be infected".

The malware seems to inject some JS payload to execute when zod is installed, by fetching it from an ethereum smart contract (if I understand it correctly).

Don't forget to flag the version on npm.

EDIT: looks like the update never got on NPM: https://news.ycombinator.com/item?id=50053253