PkgRadar

Go modules · proxy.golang.org

github.com/karmada-io/karmada

Remote Payload: matched "github.com/karmada-io/karmada/releases/download"

Why PkgRadar flagged v1.19.0-alpha.0.0.20260614173550-9657bb226e8e

SeveritySignalEvidence
mediumRemote Payloadmatched "github.com/karmada-io/karmada/releases/download" · github.com/karmada-io/[email protected]/operator/pkg/init.go
mediumRemote Payloadmatched "github.com/karmada-io/karmada/releases/download" · github.com/karmada-io/[email protected]/pkg/karmadactl/cmdinit/cmdinit.go
mediumRemote Payloadmatched "github.com/karmada-io/karmada/releases/download" · github.com/karmada-io/[email protected]/pkg/karmadactl/cmdinit/kubernetes/deploy.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v1.19.0-alpha.0.0.20260614173550-9657bb226e8eHigh risk362026-06-15
v1.19.0-alpha.0.0.20260530084012-3d7799b0215dHigh risk362026-05-31
v1.17.3High risk362026-05-31
v1.16.6High risk362026-05-31
v1.15.9High risk362026-05-31
v1.19.0-alpha.0High risk362026-05-31
v1.18.0Review362026-05-31
v1.18.0-rc.0.0.20260529094358-80ff6e5697f3Review362026-05-30
v1.13.0-alpha.0.0.20241228051829-337c27bb18a3Review362026-05-30

Block this in CI

PkgRadar gates github.com/karmada-io/karmada (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/karmada-io/[email protected]
Start free — 25 scans / moView full evidence
github.com/karmada-io/karmada — Go modules security scan | PkgRadar