GitHub malicious-dependency incident touching protocol deps

Evidence summary #

GitHub malicious-dependency monitoring applicable: BENQI-Smart-Contracts repo has npm dependencies. Repo last commit 2023-01-11; dependency pins from that date may not auto-update. No GitHub security advisory flagging a malicious dep in BENQI's dependency chain as of 2026-05-16. Requires GitHub advisory feed monitoring not yet implemented. Pipeline not implemented.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →