PkgRadar

Go modules · proxy.golang.org

github.com/nlnetlabs/unbound

Remote Payload: matched "wget "

Why PkgRadar flagged v0.0.0-20260527140315-c0741ccc68bd

SeveritySignalEvidence
mediumRemote Payloadmatched "wget " · github.com/nlnetlabs/[email protected]/makedist.sh

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.0.0-20260616084010-a45e54555dc2Low risk02026-06-17
v0.0.0-20260616083541-4693c00c9ffcLow risk02026-06-17
v0.0.0-20260616080900-81a19ebeb3ceLow risk02026-06-17
v0.0.0-20260615142635-69524cadad01Low risk02026-06-16
v0.0.0-20260612094814-a1cecf7462a2Low risk02026-06-13
v0.0.0-20260610144341-d45daaf313c7Low risk02026-06-11
v0.0.0-20260610092402-db1c6d655764Low risk02026-06-11
v0.0.0-20260609144137-e7a713a525e0Low risk02026-06-10
v0.0.0-20260608194804-39e67508c9c1Low risk02026-06-10
v0.0.0-20260603125620-3eab974ca209Low risk02026-06-05
v0.0.0-20260529101040-8e8c04e1b996Low risk02026-05-30
v0.0.0-20260527140315-c0741ccc68bdReview122026-05-29

Block this in CI

PkgRadar gates github.com/nlnetlabs/unbound (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/nlnetlabs/[email protected]
Start free — 25 scans / moView full evidence