Dependency had malicious-release incident (last 90d)
A fork / dependency lineage factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This factor monitors whether any npm, PyPI, or crates.io dependency used by the protocol has had a flagged malicious release incident in the trailing 90 days. The assessment runs on an episodic, event-driven cadence by cross-referencing the protocol's public dependency list against security advisory feeds (npm advisories, OSV database, GitHub Security Advisories). A flag is recorded if any protocol dependency appears in a confirmed supply-chain compromise report within the 90-day window.
**Why it matters** Supply-chain attacks on DeFi tooling dependencies are an emerging and undermonitored risk vector. If a protocol's deployment scripts, testing infrastructure, or build tools depend on a compromised package, a malicious actor could inject code that modifies the deployment artifact, exfiltrates private keys used in the deployment process, or corrupts test results to hide a vulnerability. While approximately two directly linked instances exist in the T-01 inventory, the supply-chain attack surface is growing as DeFi protocols use increasingly complex build pipelines with many transitive dependencies.
**Green / Yellow / Red** Green: no dependencies in the protocol's public dependency list have appeared in any supply-chain compromise advisory in the trailing 90 days. Yellow: a dependency had a flagged advisory but only for versions the protocol does not use, confirmed by the pinned version check. Red: a dependency used by the protocol at its currently pinned version is under an active supply-chain compromise advisory.
**Common gray cases** This factor is gray when the protocol does not maintain a public repository and the dependency list cannot be assessed, or when the protocol uses proprietary tooling with no public advisory channel.
**Notable historical examples** The SolarWinds-style supply-chain attack pattern motivates this factor; no direct DeFi protocol exploit is yet in the dataset.
Measurement what to look for #
Determine whether any npm/PyPI/crates.io dependency of this protocol had a flagged malicious release in the trailing 90 days.