Go modules · proxy.golang.org

github.com/slsa-framework/slsa-github-generator

Remote Payload

Why PkgRadar flagged v1.1.2-0.20220703225106-ab345b0851ac

Severity	Signal	Evidence
medium	Remote Payload	—
medium	Remote Payload	—

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v1.1.2-0.20220703225106-ab345b0851ac`	Review	24	2026-07-19
`v1.1.2-0.20220712145619-1d646d70aeba`	Review	24	2026-07-19
`v0.0.0-20250102190628-70146de10070`	Low risk	0	2026-06-25
`v0.0.0-20250102204802-bad583447374`	Low risk	0	2026-06-25
`v0.0.0-20250128183033-be0c57cb10e7`	Low risk	0	2026-06-25
`v0.0.0-20250128192028-f2d3d0f5406b`	Low risk	0	2026-06-25
`v0.0.0-20250128193303-a1cbd3a8f8e5`	Low risk	0	2026-06-25
`v0.0.0-20250128193640-44e21506677b`	Low risk	0	2026-06-25
`v0.0.0-20250128202219-0bb3fc8b486d`	Low risk	0	2026-06-25
`v0.0.0-20250129174413-74e5c8f991e4`	Low risk	0	2026-06-25
`v0.0.0-20250129201634-71b4973eb1d4`	Low risk	0	2026-06-25
`v0.0.0-20250211194253-ed8f922e441f`	Low risk	0	2026-06-25

Block this in CI

PkgRadar gates github.com/slsa-framework/slsa-github-generator (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/slsa-framework/[email protected]