GitHub malicious-dependency incident touching protocol deps

Evidence summary #

GitHub malicious-dependency incident touching protocol deps | Applicable: Yes | No GHSA advisory flagging a malicious release in a dependency consumed by Balancer v2 or v3 in the trailing 90 days identified. v2 uses Solidity 0.7.1 (data cache confirmed; Etherscan verification). v3 uses newer Solidity. No npm/PyPI/crates.io advisory found for Balancer dependencies in assessment window. v2 monorepo last commit 2025-12-14 — reduced commit activity in wind-down reduces supply-chain attack surface. v3 monorepo actively maintained. | Threshold: GHSA advisory for a malicious release in a dependency consumed by Balancer | Would fire: No

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →