Import-time code execution via query key injection

Code injection in Orval before 8.21.0 allows attackers to execute code via crafted query parameter names in OpenAPI input. In packages/zod/src/index.ts, query request-validation generation emits each parameter name as a double-quoted zod.object key without escaping embedded quotes, so a crafted name breaks into object-literal context and injects an evaluated computed property key. Exposure requires generating a zod or hono client from an attacker-controlled specification and importing the generated schema module, which executes during module load in developer, CI, test, or application environments.