PkgRadar

Go modules · proxy.golang.org

github.com/charmbracelet/crush

Go Generate Shell: //go:generate directive shells out to curl/wget/bash — runs during `go generate`.

Why PkgRadar flagged v0.76.1-0.20260611183105-3e6f95eb2409

SeveritySignalEvidence
mediumGo Generate Shell//go:generate directive shells out to curl/wget/bash — runs during `go generate`. · github.com/charmbracelet/[email protected]/internal/agent/hyper/provider.go
mediumRemote Payloadmatched "curl " · github.com/charmbracelet/[email protected]/internal/cmd/run.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.76.1-0.20260611183105-3e6f95eb2409Review322026-06-12
v0.76.1-0.20260610183939-2c9d6d40dbdfReview322026-06-11
v0.76.1-0.20260609174815-4abf2066b1d4Review322026-06-11
v0.76.1-0.20260609003714-e25d61cf03bdReview322026-06-10
v0.76.1-0.20260606200310-2030d97ec0deReview322026-06-08
v0.76.0Review322026-06-06
v0.75.1-0.20260604190143-b5fd4c08e906Review322026-06-05
v0.75.1-0.20260603205739-b688d5268710Review322026-06-05
v0.74.2-0.20260601211428-aeda508da29bReview322026-06-03
v0.74.2-0.20260601024905-d60a39419dbcReview322026-06-02
v0.74.1Review322026-05-30
v0.73.1-0.20260527142028-7d927319c403Review322026-05-30
v0.74.1-0.20260529125554-a4181d6d4eccReview322026-05-30
v0.74.1-0.20260529003947-0ee6c5b914b7Review322026-05-30
v0.74.0Review322026-05-29

Block this in CI

PkgRadar gates github.com/charmbracelet/crush (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/charmbracelet/[email protected]
Start free — 25 scans / moView full evidence