GitHub malicious-dependency incident touching protocol deps

Evidence summary #

No GitHub advisory flagging a malicious dependency in PancakeSwap's supply chain detected within trailing 90 days as of 2026-04-28. GitHub repo pancake-v3-contracts (last commit 2024-04-22, package_json_present: true). No npm supply chain incident reported for PancakeSwap dependencies in public security feeds.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →