Go modules · proxy.golang.org

github.com/hashiCorp/terraform

Remote Payload: matched "cURL "

Why PkgRadar flagged v1.16.0-alpha20260603.0.20260605204513-d038b9e6cd86

Severity	Signal	Evidence
medium	Remote Payload	matched "cURL " · github.com/hashicorp/[email protected]/tools/protobuf-compile/protobuf-compile.go
medium	Go Mod Replace Local	go.mod replace directive redirects to a local filesystem path — non-portable / dev-time only. · github.com/hashicorp/[email protected]/go.mod

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v1.16.0-alpha20260603.0.20260605204513-d038b9e6cd86`	Review	22	2026-06-08
`v1.16.0-alpha20260603`	Review	22	2026-06-08
`v1.16.0-alpha20260513.0.20260601161444-581ffab924bb`	Review	22	2026-06-03
`v1.15.5`	Review	22	2026-06-03

Block this in CI

PkgRadar gates github.com/hashiCorp/terraform (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/hashiCorp/[email protected]