GitHub malicious-dependency incident touching protocol deps

Evidence summary #

GitHub malicious-dependency incident touching protocol deps | No GHSA advisory flagging a malicious release in a dependency consumed by Across in the trailing 90 days identified. Across uses OpenZeppelin contracts (pinned version per OZ audit reports). The 2026-02-02 and 2026-02-23 audits both post-date any known OZ library malicious-release window. No npm/PyPI/crates.io advisory found for Across dependencies.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →