GitHub malicious-dependency incident touching protocol deps
Raydium's assessment for RD-F-160 — scored not_assessed on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Cat 11 threat intel signal (v1-deferred). Raydium core programs are compiled Rust/Anchor; runtime dependencies: Anchor framework, SPL Token, SPL Token-2022, Squads V4. npm/PyPI attack vectors do not apply to compiled Rust on-chain programs. Frontend (raydium-io/raydium-frontend) uses JavaScript/TypeScript with npm dependencies — a relevant surface for supply-chain attacks. Data cache: security_md_present: true (raydium-io/raydium-amm). No active GitHub security advisory or Cargo/npm malicious-release incident identified affecting Raydium's dependencies as of 2026-04-29. No GHSA flagged in available public data. Gap: full Cargo.toml dependency enumeration not performed — would require reading raydium-io/raydium-amm Cargo.toml for comprehensive assessment.
Sources #
- GitHubraydium-io/raydium-amm Security Overview — GitHubraydium-io/raydium-amm: security_md_present: true (per data cache); no active GitHub security advisory on core reposretrieved 2026-04-29
- raydium-io/raydium-clmm Security Overview — GitHubraydium-io/raydium-clmm security overview: no active advisoriesretrieved 2026-04-29
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →