PkgRadar

Go modules · proxy.golang.org

github.com/Zxilly/cjv

Remote Payload: matched "github.com/Zxilly/cangjie-docs-bundle/releases/download"

Why PkgRadar flagged v0.2.16

SeveritySignalEvidence
mediumRemote Payloadmatched "github.com/Zxilly/cangjie-docs-bundle/releases/download" · github.com/zxilly/[email protected]/internal/component/url.go
mediumRemote Payloadmatched "raw.githubusercontent.com" · github.com/zxilly/[email protected]/internal/config/manifest_default.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.2.16Review242026-06-11
v0.2.13Review242026-06-10
v0.2.16-0.20260609052548-4a2f7e7cec1aReview242026-06-10
v0.2.15Review242026-06-10

Block this in CI

PkgRadar gates github.com/Zxilly/cjv (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/Zxilly/[email protected]