GitHub malicious-dependency incident touching protocol deps

Evidence summary #

No GitHub Security Advisory flagging a malicious dependency in axelar-core (Go) or axelar-cgp-solidity (Solidity) dependencies identified as of 2026-05-17. axelar-core v1.3.10 is the current release (2026-02-17). Axelar has an active audit program with 60+ reports covering dependency surfaces. No active CVE or GHSA targeting Axelar's dependency tree found in public advisory feeds.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →