GitHub malicious-dependency incident touching protocol deps

Evidence summary #

Hyperliquid's auditable surface (Bridge2.sol) uses OpenZeppelin AdminUpgradeabilityProxy — a well-maintained, actively monitored library. The L1 node software uses a closed-source binary; dependency audit is not possible. Python SDK (hyperliquid-python-sdk) is a user-facing tool, not a protocol security-critical dependency. No GitHub security advisories flagging malicious dependencies in hyperliquid-dex org repos identified as of assessment date. Signal does not fire.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →