GitHub malicious-dependency incident touching protocol deps

Evidence summary #

No GitHub security advisories flagging malicious dependencies in aave-dao/aave-v3-origin or bgd-labs/aave-address-book in the trailing 90 days. The April 18 attack did not involve supply-chain compromise of Aave's own code dependencies.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →