The compromised code is still tagged on Github as of 2026-10-12T10:37:51: https://github.com/colinhacks/zod/releases/tag/v4.6.6. See commit d821685.