PkgRadar

Go modules · proxy.golang.org

www.velocidex.com/golang/velociraptor

Go Generate Shell: //go:generate directive shells out to curl/wget/bash — runs during `go generate`.

Why PkgRadar flagged v0.76.1-rc1.0.20260608123706-b05c578e507a

SeveritySignalEvidence
mediumGo Generate Shell//go:generate directive shells out to curl/wget/bash — runs during `go generate`. · www.velocidex.com/golang/[email protected]/vql/parsers/ese/sid.go
mediumRemote Payloadmatched "cUrl " · www.velocidex.com/golang/[email protected]/api/authenticators/auth.go
mediumRemote Payloadmatched "cUrl " · www.velocidex.com/golang/[email protected]/config/proto/config.pb.go
mediumRemote Payloadmatched "cUrl " · www.velocidex.com/golang/[email protected]/services/frontend/urls.go
mediumRemote Payloadmatched "cUrl " · www.velocidex.com/golang/[email protected]/tools/survey/compile.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.76.1-rc1.0.20260608123706-b05c578e507aHigh risk692026-06-10
v0.77.1-rc1High risk692026-06-10
v0.76.1-rc1.0.20260602100428-b490f6d5b7b9High risk692026-06-04
v0.76.6High risk692026-06-04
v0.76.1-rc1.0.20260528000610-1b88e482c1a2High risk692026-06-02

Block this in CI

PkgRadar gates www.velocidex.com/golang/velociraptor (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go www.velocidex.com/golang/[email protected]