GitHub malicious-dependency incident touching protocol deps

Evidence summary #

No public GitHub security advisory flagging malicious release in morpho-org dependencies in trailing 90 days. morpho-blue uses Foundry toolchain (not npm); package_json_present: false reduces npm supply-chain attack surface significantly.

Detail #

Data cache: package_json_present: false; foundry_toml_present: true. Foundry-based build eliminates standard npm dependency supply chain vector. No GHSA alerts on morpho-org repos found via GitHub security overview search. oz_contracts_version: null (no OZ npm lib in scope).

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →