GitHub malicious-dependency incident touching protocol deps

Evidence summary #

GitHub malicious-dependency incident touching protocol deps. Orca's orca-so/whirlpools is public. Dependencies: Anchor framework (Rust), SPL Token program, SPL Token-2022, standard Rust crates. No active GHSA advisory targeting Anchor framework or Orca's Rust dependencies identified in public data as of 2026-05-16. No malicious npm or crate release advisory for Orca's specific dependency set found.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →