# Zod 58 Hacker News commenters recommended Zod and 20 criticized it, November 2025 to November 2026. It was recommended in 11 of 13 months. It meets the Hacker Approved badge rule. **Verdict:** Popular TypeScript schema library that validates untrusted data at boundaries and infers static types. Critics cite added dependency weight, inferred-type quirks, and the reported 4.6.6 malware compromise. ## Why people recommend it - Validates data at API boundaries (7 comments): "undeniably the best part about zod. Yes, you could define all of your types this way, but it's only necessary at the boundary of the program" ([source](https://news.ycombinator.com/item?id=48736388)) "Whenever I write an API I'll use Zod and whatever middlewares my framework needs to generate json schema for consumers" ([source](https://news.ycombinator.com/item?id=48012050)) "it can be significantly improved upon by using a library to verify the structure of deserialized data" ([source](https://news.ycombinator.com/item?id=45921821)) - Ergonomic and easy to use (5 comments): "Zod is by far the most ergonomic way to express those ideas in TypeScript these days." ([source](https://news.ycombinator.com/item?id=48732002)) "Zod is more ergonomic, has easier apis and is perfect for most users" ([source](https://news.ycombinator.com/item?id=48732354)) "Found it pretty easy to use, and it's helped clean things up a good bit" ([source](https://news.ycombinator.com/item?id=49493749)) - Generates static TypeScript types (3 comments): "For runtime types I've leaned on Zod or Effect schema,which can also generate static types for you." ([source](https://news.ycombinator.com/item?id=48392530)) "I'm a fan of using satisfies to check Zod definitions against the interfaces they validate." ([source](https://news.ycombinator.com/item?id=46019329)) "which I'd say shines in representing typescript's type system in code" ([source](https://news.ycombinator.com/item?id=48605464)) - Works well with TypeScript frontends (3 comments): "I've got it well integrated with Zod for type safe JS/TS front-ends as well." ([source](https://news.ycombinator.com/item?id=47464112)) "using Hono + Zod has been brilliant for creating types that my frontend can consume" ([source](https://news.ycombinator.com/item?id=46856870)) "we just use Zod's branded type and that pretty much handles it" ([source](https://news.ycombinator.com/item?id=47996209)) ## What people warn about - Adds runtime dependency and boilerplate (5 comments): "zod can't be a dev only dependency, and you have to deal with breaking changes and maybe switching to a completely different library in a few years" ([source](https://news.ycombinator.com/item?id=48734538)) "now you have added a massive runtime dependency instead of local validation" ([source](https://news.ycombinator.com/item?id=48849785)) "how much code is spent simply producing an enormous amount of Zod schemas and unit tests around them" ([source](https://news.ycombinator.com/item?id=49804555)) - Security concern after 4.6.6 compromise (5 comments): "They cut and submitted a compromised release to npm; npm just happened to block the publishing." ([source](https://news.ycombinator.com/item?id=50053516)) "It definitely doesn't inspire confidence in the project taking security seriously." ([source](https://news.ycombinator.com/item?id=50054339)) "The malware seems to inject some JS payload to execute when zod is installed" ([source](https://news.ycombinator.com/item?id=50053202)) - Inferred types hurt IntelliSense (2 comments): "then have to deal with the inferred types which among other things tend to suck for IntelliSense etc." ([source](https://news.ycombinator.com/item?id=48733411)) "it's a lot easier to work with types you've declared in TypeScript than the ones Zod generates" ([source](https://news.ycombinator.com/item?id=46021657)) - Poor fit for some use cases (3 comments): "Zod was really not designed for the use-cases I want JSON schemas for" ([source](https://news.ycombinator.com/item?id=46023532)) "Zod is quite unpleasant to use, IME, an has some edge cases where you lose code comments." ([source](https://news.ycombinator.com/item?id=46023607)) "instead of zod, you should use the @standard-schema/spec package" ([source](https://news.ycombinator.com/item?id=45959134)) ## Alternatives hackers recommend - [Pydantic](https://hackerapproved.com/p/pydantic.md): 62 recommend - [clojure.spec](https://hackerapproved.com/p/clojure-spec.md): 18 recommend - [Malli](https://hackerapproved.com/p/malli.md): 15 recommend - [Guardrails AI](https://hackerapproved.com/p/guardrails.md): 5 recommend ## Cite as Hacker Approved, "Zod", https://hackerapproved.com/p/zod/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).