GitHub malicious-dependency incident touching protocol deps

Evidence summary #

T-09 phase-2 signal. Beefy contracts use OpenZeppelin libraries (ERC20Upgradeable, OwnableUpgradeable, ClonesUpgradeable). No GitHub security advisory (GHSA) or npm security advisory for OpenZeppelin or other Beefy dependencies filed within the last 90 days as of 2026-05-16. The beefy-contracts repo uses standard OZ dependencies. No known malicious-release incident on Beefy's dependency chain at this date.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →