Dependency had malicious-release incident (last 90d)
Symbiotic's assessment for RD-F-134 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No malicious npm package release incident found for @openzeppelin/contracts in trailing 90 days. OZ is a high-scrutiny, well-maintained library. No GitHub security advisory flagging malicious release for OZ 5.x in trailing 90 days.
Sources #
- URLOpenZeppelin Contracts Security OverviewOpenZeppelin GitHub security overview - no malicious release advisory for OZ 5.x in trailing 90 daysretrieved 2026-05-16
- ReversingLabs OZ 5.0.2 Vulnerability ScanReversingLabs scan: no known vulnerabilities for OZ 5.0.2retrieved 2026-05-16
Methodology #
Determine whether any npm/PyPI/crates.io dependency of this protocol had a flagged malicious release in the trailing 90 days.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol symbiotic factor RD-F-134 score green collected_at 2026-05-16 09:25:24