PkgRadar

Go modules · proxy.golang.org

github.com/tobiaswaelti/govmomi

Remote Payload: matched "curl "

Why PkgRadar flagged v0.0.0-20260605075307-39f15a80bf7f

SeveritySignalEvidence
mediumRemote Payloadmatched "curl " · github.com/tobiaswaelti/[email protected]/cli/about/cert.go
mediumRemote Payloadmatched "curl " · github.com/tobiaswaelti/[email protected]/cli/vm/guest/run.go
mediumRemote Payloadmatched "cUrl " · github.com/tobiaswaelti/[email protected]/lookup/types/types.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.0.0-20260605075307-39f15a80bf7fHigh risk412026-06-06
v0.0.0-20260604141625-7c323ae59c38High risk412026-06-06
v0.0.0-20260603064434-ef9731646fc0High risk412026-06-04
v0.0.0-20260602095930-8b90b46c108dHigh risk412026-06-03
v0.0.0-20260602093701-026a2b5e2991High risk412026-06-03

Block this in CI

PkgRadar gates github.com/tobiaswaelti/govmomi (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/tobiaswaelti/[email protected]
Start free — 25 scans / moView full evidence