Dependency had malicious-release incident (last 90d)

Superstate's assessment for RD-F-134 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Factor assesses fork-inherited dependency malicious-release risk. Not applicable for original-design protocols. OZ v4.9.3 (pinned) has no active malicious-release advisory (GHSA-g4vp-m682-qqmp is a functional edge case, not malicious release).

Sources #

GitHub
OZ upgradeable v4.9.3 release (no malicious-release advisory)OZ upgradeable v4.9.3 release notes: GHSA-g4vp-m682-qqmp is ERC2771Context functional fix, not malicious releaseretrieved 2026-05-16

Methodology #

Determine whether any npm/PyPI/crates.io dependency of this protocol had a flagged malicious release in the trailing 90 days.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol superstate factor RD-F-134 score not_applicable collected_at 2026-05-16 00:06:37