GitHub malicious-dependency incident touching protocol deps
Meteora's assessment for RD-F-160 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Cat 11 threat intelligence signal. No security advisory flagged for Rust/Anchor crates or npm dependencies used by MeteoraAg repos in public sources as of 2026-05-16. MeteoraAg GitHub org shows no public critical security advisories in data-cache. Meteora uses Rust/Anchor toolchain (Solana BPF programs); supply chain risk via crates.io is a monitoring surface but no current malicious-release incident identified. Data-cache shows no GitHub security advisory events flagged.
Sources #
- GitHubMeteoraAg GitHub OrganizationMeteoraAg GitHub org: active Rust/Anchor development; no security advisory files present in public repo (security_md_present: false per data-cache); no public GHSA advisories flaggedretrieved 2026-05-16
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →