GitHub malicious-dependency incident touching protocol deps

Evidence summary #

No active GHSA advisory for malicious release affecting OZ Contracts 4.8.3 or known compound-finance/comet dependencies. OpenZeppelin continuous security partnership provides ongoing advisory coverage.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →