Go modules · proxy.golang.org

github.com/charmbracelet/crush

Go Generate Shell, Remote Payload, Credential file access

Why PkgRadar flagged v0.87.1-0.20260727195440-aa57f56120d3

Severity	Signal	Evidence
medium	Go Generate Shell	—
medium	Remote Payload	—

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.87.1-0.20260727195440-aa57f56120d3`	Review	32	2026-07-29
`v0.87.1-0.20260726200421-def12cc6d8e1`	Review	32	2026-07-28
`v0.87.1-0.20260725193737-677046d28d5f`	Review	32	2026-07-26
`v0.87.1-0.20260724235750-35fd87b68e87`	Review	32	2026-07-26
`v0.86.1-0.20260721210451-557429fbc4d2`	Review	32	2026-07-23
`v0.86.1-0.20260721131937-9c4e2f673aea`	Review	32	2026-07-22
`v0.86.0`	Review	32	2026-07-21
`v0.85.1-0.20260720131257-a1fb8fe3ec94`	Review	32	2026-07-21
`v0.85.1-0.20260719133501-d1626158d058`	Review	32	2026-07-20
`v0.85.1-0.20260718032238-842e1e7d6209`	Review	44	2026-07-20
`v0.85.1-0.20260718172646-4f4b84695dbb`	Review	32	2026-07-19
`v0.85.1-0.20260718035040-461976d035ef`	Review	32

Block this in CI

PkgRadar gates github.com/charmbracelet/crush (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/charmbracelet/[email protected]