Go modules · proxy.golang.org

github.com/netbirdio/netbird

Remote Payload: matched "github.com/netbirdio/netbird/releases/download"

Why PkgRadar flagged v0.71.5-0.20260604153645-512899d82d88

Severity	Signal	Evidence
medium	Remote Payload	matched "github.com/netbirdio/netbird/releases/download" · github.com/netbirdio/[email protected]/client/internal/updater/installer/installer_run_darwin.go
medium	Remote Payload	matched "github.com/netbirdio/netbird/releases/download" · github.com/netbirdio/[email protected]/client/internal/updater/installer/installer_run_windows.go
medium	Remote Payload	matched "cURL " · github.com/netbirdio/[email protected]/proxy/internal/auth/middleware.go
medium	Remote Payload	matched "CURL " · github.com/netbirdio/[email protected]/shared/management/proto/proxy_service_grpc.pb.go

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.71.5-0.20260604153645-512899d82d88`	High risk	53	2026-06-05
`v0.71.5-0.20260601173800-e7c9182ff93b`	High risk	53	2026-06-05

Block this in CI

PkgRadar gates github.com/netbirdio/netbird (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/netbirdio/[email protected]