GitHub malicious-dependency incident touching protocol deps

Evidence summary #

No malicious dependency release advisories in trailing 90 days affecting Centrifuge's dependency tree found in public search results. No npm security advisory flagging centrifuge/protocol dependencies. No GitHub security advisory for centrifuge/protocol package dependencies.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →