PkgRadar

Go modules · proxy.golang.org

gocloud.dev

Remote Payload: matched "cURL "

Why PkgRadar flagged v0.46.1-0.20260612183815-312b010f0305

SeveritySignalEvidence
mediumRemote Payloadmatched "cURL " · [email protected]/blob/azureblob/azureblob.go
mediumRemote Payloadmatched "wGet " · [email protected]/runtimevar/awsparamstore/awsparamstore.go
mediumRemote Payloadmatched "wGet " · [email protected]/runtimevar/awssecretsmanager/awssecretsmanager.go
mediumCredential file accessmatched "GOOGLE_APPLICATION_CREDENTIALS" · [email protected]/internal/testing/setup/setup.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.46.1-0.20260612183815-312b010f0305High risk462026-06-15
v0.46.1-0.20260611222651-d4a02bee45efHigh risk462026-06-13
v0.46.1-0.20260607225017-ab9d33564de3High risk462026-06-10
v0.46.1-0.20260606192545-dd099c2ce139High risk462026-06-08
v0.15.1-0.20190629105727-19023f462f63Review392026-06-08
v0.46.1-0.20260604165655-9558213dfd0cHigh risk462026-06-05
v0.46.1-0.20260604160954-0ab18bab8478High risk462026-06-05
v0.46.1-0.20260602230154-e364d60fc90cHigh risk462026-06-05
v0.46.0High risk462026-06-03
v0.45.1-0.20260528222604-7eadd65be3cfReview462026-05-30

Block this in CI

PkgRadar gates gocloud.dev (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go [email protected]
Start free — 25 scans / moView full evidence