Go modules · proxy.golang.org
www.velocidex.com/golang/velociraptor
Go Generate Shell: //go:generate directive shells out to curl/wget/bash — runs during `go generate`.
Why PkgRadar flagged v0.76.1-rc1.0.20260608123706-b05c578e507a
| Severity | Signal | Evidence |
|---|---|---|
| medium | Go Generate Shell | //go:generate directive shells out to curl/wget/bash — runs during `go generate`. · www.velocidex.com/golang/[email protected]/vql/parsers/ese/sid.go |
| medium | Remote Payload | matched "cUrl " · www.velocidex.com/golang/[email protected]/api/authenticators/auth.go |
| medium | Remote Payload | matched "cUrl " · www.velocidex.com/golang/[email protected]/config/proto/config.pb.go |
| medium | Remote Payload | matched "cUrl " · www.velocidex.com/golang/[email protected]/services/frontend/urls.go |
| medium | Remote Payload | matched "cUrl " · www.velocidex.com/golang/[email protected]/tools/survey/compile.go |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
v0.76.1-rc1.0.20260608123706-b05c578e507a | High risk | 69 | 2026-06-10 |
v0.77.1-rc1 | High risk | 69 | 2026-06-10 |
v0.76.1-rc1.0.20260602100428-b490f6d5b7b9 | High risk | 69 | 2026-06-04 |
v0.76.6 | High risk | 69 | 2026-06-04 |
v0.76.1-rc1.0.20260528000610-1b88e482c1a2 | High risk | 69 | 2026-06-02 |
Block this in CI
pkgradar gate --ecosystem go www.velocidex.com/golang/[email protected]