GitHub malicious-dependency incident touching protocol deps
Concrete's assessment for RD-F-160 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
GitHub malicious-dependency incident: no malicious release found affecting Concrete's dependency tree. Protocol uses OpenZeppelin Contracts v5.2.0 (confirmed from data cache §sources.github.oz_contracts_version). No GitHub Security Advisory (GHSA) or npm advisory for OZ 5.2.0 modules used by Concrete (AccessControlUpgradeable, OwnableUpgradeable, UUPS proxy) as of 2026-05-17. No other runtime npm dependencies identified in data cache (foundry-based Solidity project with no package.json runtime deps). No known malicious release in trailing 90 days affecting this protocol's direct dependency tree.
Sources #
- GitHubOpenZeppelin Contracts v5.2.0 release — no malicious release advisoryOpenZeppelin Contracts v5.2.0 — no malicious release advisory in GitHub Security Advisories as of 2026-05-17retrieved 2026-05-17
- Concrete data cache — OZ 5.2.0 dependencydata cache §sources.github.oz_contracts_version='5.2.0' — OpenZeppelin Contracts v5.2.0 usedretrieved 2026-05-17
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →