detecting-dependency-confusion

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CI workflow and prerequisites explicitly run "go install github.com/visma-prodsec/confused@latest" and then execute the installed confused binary, so the repository URL https://github.com/visma-prodsec/confused is fetched at runtime and results in executing remote code from that external source.