PkgRadar

Go modules · proxy.golang.org

encr.dev

Remote Payload: matched "raw.githubusercontent.com"

Why PkgRadar flagged v0.0.0-20260602135951-0993633cb60c

SeveritySignalEvidence
mediumRemote Payloadmatched "raw.githubusercontent.com" · [email protected]/cli/cmd/encore/app/create_form.go
mediumRemote Payloadmatched "curl " · [email protected]/cli/cmd/encore/check.go
mediumRemote Payloadmatched "raw.githubusercontent.com" · [email protected]/cli/cmd/encore/llm_rules/tool.go
mediumRemote Payloadmatched "cURL " · [email protected]/cli/daemon/run/runtime_config2.go
mediumRemote Payloadmatched "curl " · [email protected]/cli/daemon/run_spec.go
mediumRemote Payloadmatched "curl " · [email protected]/cli/internal/update/update.go
mediumRemote Payloadmatched "cURL " · [email protected]/v2/app/validate_objects.go
mediumRemote Payloadmatched "cURL " · [email protected]/v2/parser/infra/objects/errors.go
mediumRemote Payloadmatched "cURL " · [email protected]/v2/parser/infra/objects/usage.go
mediumGo Mod Replace Localgo.mod replace directive redirects to a local filesystem path — non-portable / dev-time only. · [email protected]/go.mod

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.0.0-20260602135951-0993633cb60cHigh risk1102026-06-03
v1.57.6-0.20260529100630-a9c45a0215b5Review1102026-05-30

Block this in CI

PkgRadar gates encr.dev (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go [email protected]