PkgRadar

Go modules · proxy.golang.org

github.com/go-pkgz/auth

Remote Payload: matched "curl "

Why PkgRadar flagged v1.25.5-0.20260525164304-54502eeba7ed

SeveritySignalEvidence
mediumRemote Payloadmatched "curl " · github.com/go-pkgz/[email protected]/go.sum
mediumRemote Payloadmatched "cURL\n\t\t" · github.com/go-pkgz/[email protected]/provider/verify.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v1.25.5-0.20260525164304-54502eeba7edReview292026-05-30
v0.0.0-20260525164304-54502eeba7edReview292026-05-30

Block this in CI

PkgRadar gates github.com/go-pkgz/auth (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/go-pkgz/[email protected]