PkgRadar

Go modules · proxy.golang.org

github.com/drone-runners/drone-runner-aws

Remote Payload: matched "wget "

Why PkgRadar flagged v1.0.0-rc.284

SeveritySignalEvidence
mediumRemote Payloadmatched "wget " · github.com/drone-runners/[email protected]/app/oshelp/oshelp.go
mediumRemote Payloadmatched "github.com/drone/plugin/releases/download" · github.com/drone-runners/[email protected]/command/config/config.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v1.0.0-rc.284Review422026-06-11
v1.0.0-rc.283Review422026-06-06
v1.0.0-rc.285-debug2Review422026-06-03
v1.0.0-rc.285-debug1Review422026-06-03
v1.0.0-rc.284-debugReview422026-06-02
v1.0.0-rc.282Review422026-06-02
v1.0.0-rc.283-debugReview422026-06-02

Block this in CI

PkgRadar gates github.com/drone-runners/drone-runner-aws (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/drone-runners/[email protected]