Go modules · proxy.golang.org

github.com/anchore/syft

Remote Payload

Why PkgRadar flagged v1.51.2-0.20260902082704-77031752faf6

Severity	Signal
medium	Remote Payload ×2

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v1.51.2-0.20260902082704-77031752faf6`	Review	24	2026-09-03
`v1.51.2-0.20260829102402-af937d74c00c`	Review	24	2026-08-31
`v0.84.1-0.20230622160538-f79cb9587f68`	Review	17	2026-08-31
`v1.51.2-0.20260828133327-401797967055`	Review	24	2026-08-29
`v1.51.1`	Review	24	2026-08-28
`v1.51.1-0.20260827042009-d3734ddeb2d6`	Review	24	2026-08-28
`v0.0.0-20221102153157-9634b42746d1`	Review	29	2026-08-24
`v0.0.0-20221102140520-35f0f2931e31`	Review	29	2026-08-24
`v0.84.1-0.20230622184210-7de7a7990a0d`	Review	17	2026-08-23
`v1.6.1-0.20240613162753-9beaec2e97c3`	Review	12	2026-08-23
`v0.104.1-0.20240214205738-a909e3cec92d`	Review	12	2026-08-23
`v1.51.1-0.20260821213647-bf82010f3c38`	Review	24	2026-08-23

Block this in CI

PkgRadar gates github.com/anchore/syft (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/anchore/[email protected]

Prefer zero config? Install the GitHub App and it gates every pull request automatically — no pipeline edits, no API key.