GitHub malicious-dependency incident touching protocol deps

Evidence summary #

GitHub malicious-dependency incident | Applicable: Yes (npm dependencies, OZ 5.0.2) | No GitHub Security Advisory (GHSA) for OpenZeppelin 5.0.2 or other Lombard dependencies confirmed at assessment date. OZ 5.x is current with no known critical advisories. No malicious-release incident affecting Lombard dependency stack identified. Signal not firing.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →