Go modules · proxy.golang.org

github.com/gptscript-ai/otto

Remote Payload, Credential file access, Obfuscation Density

Why PkgRadar flagged v0.26.0-alpha1.0.20260806003303-497a8b6ab20b

Severity	Signal	Evidence
medium	Remote Payload	—
medium	Remote Payload	—

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.26.0-alpha1.0.20260806003303-497a8b6ab20b`	Review	27	2026-08-07
`v0.26.0-alpha1`	Review	27	2026-08-07
`v0.25.0-rc1`	Review	15	2026-08-07
`v0.25.2-0.20260803193209-33890ae1104d`	Review	15	2026-08-04
`v0.25.1`	Review	15	2026-08-04
`v0.25.0`	Review	15	2026-08-01
`v0.24.0`	Review	15	2026-07-27
`v0.23.4-rc1`	Low risk	0	2026-07-27
`v0.24.2-0.20260724230716-802c81619d1c`	Review	15	2026-07-27
`v0.24.1`	Review	15	2026-07-27
`v0.23.2-0.20260717195109-582f19d2f8bc`	Low risk	0	2026-07-18
`v0.23.4`	Low risk	0	2026-07-18
`v0.23.0-rc2`	Low risk	0	2026-07-09
`v0.23.0-rc1`	Low risk	0

Block this in CI

PkgRadar gates github.com/gptscript-ai/otto (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/gptscript-ai/[email protected]

Prefer zero config? Install the GitHub App and it gates every pull request automatically — no pipeline edits, no API key.