No. Fetching a Go module with go get or building it does not execute code from that module. The Go team calls the absence of install-time scripts an explicit security design goal. But once a package is compiled into your program, its init functions run when the program starts.
What the Go team says
The Go supply chain article states that fetching and building do not execute code, and describes it as an explicit security design goal of the toolchain. It also states a limit: within a build, there is no security boundary, because any package that contributes to the build can define an init function.
Where code does and does not run
| Moment | Dependency code runs? |
|---|---|
| go get or go mod download | No |
| go build | Compiled, not executed, though cgo invokes a C compiler |
| Your program starts | Yes, init functions and everything you call |
| go test | Yes, test code of your own packages |
| go generate | Only if you run it, and it runs commands named in source comments |
The last two rows are about your own workflow. go generate runs commands listed in //go:generate comments in your source. It is never run by go build, so the risk is a developer running a generator they did not read.
Why this reduces some attacks
Package managers with install scripts let a malicious release run on a developer laptop the moment it is installed. Go removes that step. It also has no package repository accounts, which the Go team notes means there are no registry credentials to steal and publish with.
That is not the same as no risk. A malicious module that you import still executes at runtime with your program's permissions.
Practical steps
- Review new imports as code that will run in production, because it will.
- Search a new dependency for
func init()and for packages with side effects at import, such as network calls. - Be careful with
go generatein someone else's repository. Read the directives first. - Be careful with cgo, which compiles C code and runs a compiler as part of the build.
- Keep dependency counts low, and prefer the standard library where it covers the need.
- Use a reachability aware scanner so you know which vulnerable functions your program can actually call.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings change when only reachable code is counted.
Where Safeguard fits
Safeguard offers reachability analysis and dependency scanning, plus policy gates on pull requests. A free scan shows findings for a Go repository.
Quick check
Can a Go dependency run code at install time?
The Go team says no: fetching and building do not execute code, by design.
Can it run code at all?
Yes. Once imported, its init functions and any code you call run inside your program.
Sources
Last reviewed: 19 October 2026.
