GitHub malicious-dependency incident touching protocol deps
JustLend DAO's assessment for RD-F-160 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
GitHub-flagged malicious-dependency incident — applicable (substrate-agnostic via GitHub). JustLend has public GitHub repo (github.com/justlend/justlend-protocol); data cache package_json_present = true, security_md_present = false. No public GHSA or npm security advisory affecting justlend-protocol dependencies found in this session. Last commit 2026-03-24. P1 signal; GitHub advisory monitoring not in production pipeline.
Sources #
- GitHubJustLend Protocol GitHub RepositoryJustLend Protocol GitHub — last_commit_date = 2026-03-24, package_json_present = true, security_md_present = false (data cache)retrieved 2026-05-17
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →