GitHub malicious-dependency incident touching protocol deps
Wormhole's assessment for RD-F-160 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
wormhole-foundation/wormhole has no `package.json` or `foundry.toml` at repo root per data cache (`package_json_present: false`, `foundry_toml_present: false`); dependency graph for Rust/Go/Move components not assessed by pipeline | Cannot fully assess — pipeline limited to EVM tooling detection; Rust `Cargo.toml` and Go modules not scanned
Sources #
- Curator noteExtracted from 06-realtime-intel.md — RD-F-160; no URL citedretrieved 2026-04-28
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol wormhole factor RD-F-160 score gray collected_at 2026-04-28 01:38:43