Go modules · proxy.golang.org

cloudeng.io/webapp/cmd/acme

Remote Payload: matched "curl "

Why PkgRadar flagged v0.0.0-20260609232111-574307bdd919

Severity	Signal	Evidence
medium	Remote Payload	matched "curl " · cloudeng.io/webapp/cmd/[email protected]/main.go
medium	Go Mod Replace Local	go.mod replace directive redirects to a local filesystem path — non-portable / dev-time only. · cloudeng.io/webapp/cmd/[email protected]/go.mod

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.0.0-20260609232111-574307bdd919`	Review	22	2026-06-11
`v0.0.0-20260608165259-4ffa3712690d`	Review	22	2026-06-10
`v0.0.0-20260607173532-ff0561849e93`	Review	22	2026-06-08
`v0.0.0-20260606221604-4cc4660e2cde`	Review	22	2026-06-08
`v0.0.0-20260604230134-a7fc8ec0fc4e`	Review	22	2026-06-05
`v0.0.0-20260604212314-889a0d829f80`	Review	22	2026-06-05
`v0.0.0-20260528224308-d8821f54f73b`	Review	22	2026-05-30

Block this in CI

PkgRadar gates cloudeng.io/webapp/cmd/acme (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go cloudeng.io/webapp/cmd/[email protected]