Go modules · proxy.golang.org

github.com/nektos/act

Remote Payload

Why PkgRadar flagged v0.2.21-0.20210313002510-09679f0156b5

Severity	Signal
medium	Remote Payload

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.2.21-0.20210313002510-09679f0156b5`	Review	12	2026-08-25
`v0.2.35-0.20221209102532-7d9951200f36`	Review	12	2026-08-08
`v0.2.2-0.20200221020630-e371fa8c4926`	Low risk	0	2026-07-28
`v0.2.25-0.20220524133606-943a0e6eea2f`	Low risk	0	2026-07-20
`v0.2.27-0.20220524133606-943a0e6eea2f`	Low risk	0	2026-07-20
`v0.2.18-0.20210112063943-15eaa15a0e2e`	Low risk	0	2026-07-20
`v0.2.33-0.20221006215816-679cac167726`	Low risk	0	2026-07-19
`v0.2.45-0.20230428155740-d77991c95ab6`	Low risk	0	2026-07-17
`v0.2.21-0.20210504215035-0f049426f632`	Low risk	0	2026-07-06
`v0.0.0-20260601031732-4f411281417e`	Low risk	0	2026-06-25
`v0.2.89`	Low risk	0	2026-06-02

Verdict reflects the highest-severity signal, not just the additive score: a single high-severity finding outranks a higher score made up of lower-severity ones, so a lower-scored version can still carry the stronger verdict.

Block this in CI

PkgRadar gates github.com/nektos/act (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/nektos/[email protected]

Prefer zero config? Install the GitHub App and it gates every pull request automatically — no pipeline edits, no API key.

Start free — 25 scans / mo View full evidence