GitHub malicious-dependency incident touching protocol deps

Evidence summary #

Signal not firing. GitHub shows 0 security advisories for klend. No GitHub security advisory flagging a malicious release in Kamino's Rust/Anchor dependency tree identified.

Detail #

Kamino klend uses Rust (99.9%) and Anchor framework. GitHub repo shows 0 security advisories (confirmed via fetch 2026-04-27). No malicious release in Anchor or Solana-ecosystem Rust crates identified in available advisory feeds.

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →