PkgRadar

Go modules · proxy.golang.org

github.com/jahwag/clem

Remote Payload: matched "curl "

Why PkgRadar flagged v0.18.1

SeveritySignalEvidence
mediumRemote Payloadmatched "curl " · github.com/jahwag/[email protected]/cmd/init.go
mediumRemote Payloadmatched "curl " · github.com/jahwag/[email protected]/internal/githubwatch/githubwatch.go
mediumRemote Payloadmatched "curl " · github.com/jahwag/[email protected]/internal/runner/runner.go
mediumCredential file accessmatched "id_rsa" · github.com/jahwag/[email protected]/internal/agent/manager.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.18.1High risk462026-06-15
v0.18.0High risk462026-06-15
v0.15.0Review342026-06-15
v0.17.1-0.20260614053223-d2913abfd2e0High risk462026-06-15
v0.17.0High risk462026-06-15
v0.16.0Review342026-06-14
v0.15.1Review342026-06-14
v0.14.1-0.20260610214757-d62e1f19f487Review342026-06-12
v0.12.0Review342026-06-12
v0.10.1Review342026-06-02
v0.10.0Review342026-06-02
v0.11.1-0.20260530171047-a9f18c16c72fReview342026-06-02

Block this in CI

PkgRadar gates github.com/jahwag/clem (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/jahwag/[email protected]
Start free — 25 scans / moView full evidence