Dependency had malicious-release incident (last 90d)

Raydium's assessment for RD-F-134 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No malicious-release advisory found in RustSec for anchor-lang, anchor-spl, solana-program, spl-token, or bytemuck in the 90 days preceding assessment. The uint git dependency (raydium-io/parity-common) is under Raydium's own GitHub org — not an external supply-chain risk. Recent audits (Sec3 Q3 2025, Sec3 Q2 2026) provide additional coverage.

Sources #

URL
RustSec advisory DB — no relevant advisories in windowRustSec advisory database (no anchor/solana malicious release in 90d)retrieved 2026-04-29

Methodology #

Determine whether any npm/PyPI/crates.io dependency of this protocol had a flagged malicious release in the trailing 90 days.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol raydium factor RD-F-134 score green collected_at 2026-04-29 12:31:55