PkgRadar

Go modules · proxy.golang.org

github.com/TruffleSecurity/trufflehog/v3

Webhook Exfil Endpoint: matched "canarytokens.org"

Why PkgRadar flagged v3.90.1

SeveritySignalEvidence
highWebhook Exfil Endpointmatched "canarytokens.org" · github.com/trufflesecurity/trufflehog/[email protected]/pkg/detectors/aws/access_keys/canary.go
mediumRemote Payloadmatched "cURL " · github.com/trufflesecurity/trufflehog/[email protected]/pkg/analyzer/analyzers/ngrok/models.go
mediumRemote Payloadmatched "curl " · github.com/trufflesecurity/trufflehog/[email protected]/pkg/analyzer/analyzers/slack/permissions.go
mediumRemote Payloadmatched "api.github.com/graphql" · github.com/trufflesecurity/trufflehog/[email protected]/pkg/sources/github_experimental/object_discovery.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v3.54.1Review102026-06-04
v3.90.1High risk1162026-06-04
v3.63.1Review152026-06-04
v3.80.2High risk552026-06-04
v3.83.6High risk792026-06-04
v3.88.8High risk892026-06-04
v3.90.8High risk1402026-06-04
v3.89.2High risk1162026-06-04
v3.88.4High risk892026-06-04
v3.90.10High risk1402026-06-04
v3.88.23High risk892026-06-04
v3.88.32High risk1162026-06-04
v3.85.0High risk892026-06-04
v3.83.3High risk792026-06-04
v3.88.20High risk892026-06-04
v3.95.0High risk1452026-06-04
v3.88.5High risk892026-06-04
v3.93.2High risk1402026-06-04
v3.88.28High risk992026-06-04
v3.87.1High risk892026-06-04
v3.83.2High risk792026-06-04
v3.83.0High risk792026-06-04
v3.94.2High risk1402026-06-04
v3.86.0High risk892026-06-04
v3.95.5High risk1452026-06-04

Block this in CI

PkgRadar gates github.com/TruffleSecurity/trufflehog/v3 (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/TruffleSecurity/trufflehog/[email protected]
Start free — 25 scans / moView full evidence