GitHub malicious-dependency incident touching protocol deps

Evidence summary #

No current GitHub security advisory flagging a malicious release in Sushi's npm or Hardhat dependency tree. sushi-labs/sushiswap security tab explicitly states no published security advisories. MISO 2021 supply-chain attack was a contractor code injection, not a malicious npm package release — different attack class. OZ 3.1.0 (per data-cache for v2-core) is not flagged with current CVEs relevant to Sushi's usage patterns.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →