Summary
Togoder Security scanned the Go package cloud.google.com/go/compute/metadata@v0.9.0 on Oct 5, 2026. An AI review of 8 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
Findings
No findings. The reviewer saw nothing malicious or risky in this version.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| internal/version.go | safe | Cleared by Jev triage; no further analysis needed |
| log.go | safe | No malicious patterns detected; the code is a legitimate logging utility for HTTP requests and responses with no data exfiltration or other suspicious behavior. |
| metadata.go | safe | This is the legitimate Google Cloud Compute metadata package (cloud.google.com/go/compute/metadata) which only communicates with the local GCE metadata server at 169.254.169.254 or a host specified via GCE_METADATA_HOST, with no malicious patterns, exfiltration, or backdoors. |
| retry.go | safe | Cleared by Jev triage; no further analysis needed |
| retry_linux.go | safe | No malicious patterns detected; the code only configures retryable syscall errors for Linux. |
| syscheck.go | safe | Cleared by Jev triage; no further analysis needed |
| syscheck_linux.go | safe | No malicious patterns detected; the code only reads a system DMI file to detect Google Cloud environment. |
| syscheck_windows.go | safe | The code only reads a non-sensitive registry key to detect if running on Google Compute Engine, with no malicious patterns detected |
Frequently asked questions
Is cloud.google.com/go/compute/metadata safe to use?
Our AI source review of cloud.google.com/go/compute/metadata@v0.9.0 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does cloud.google.com/go/compute/metadata contain malware?
No malware was identified in cloud.google.com/go/compute/metadata@v0.9.0 when Togoder Security scanned it on Oct 5, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was cloud.google.com/go/compute/metadata checked?
Togoder Security downloaded the published Go package and had an AI model read its 8 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan cloud.google.com/go/compute/metadata together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in cloud.google.com/go/compute/metadata@v0.9.0, cost nothing.