PkgRadar

Go modules · proxy.golang.org

github.com/jetify-com/devbox

Remote Payload: matched "raw.githubusercontent.com"

Why PkgRadar flagged v0.0.0-20260609223142-11322d5ba0e4

SeveritySignalEvidence
mediumRemote Payloadmatched "raw.githubusercontent.com" · github.com/jetify-com/[email protected]/internal/devconfig/config.go
mediumRemote Payloadmatched "raw.githubusercontent.com" · github.com/jetify-com/[email protected]/internal/plugin/github.go
mediumRemote Payloadmatched "curl " · github.com/jetify-com/[email protected]/internal/vercheck/vercheck.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.0.0-20260609223142-11322d5ba0e4High risk462026-06-11
v0.0.0-20260607184135-6235efab23a8High risk462026-06-08
v0.0.0-20241206164708-270f8b2a010fHigh risk582026-06-08
v0.0.0-20260606002939-75f5ed84a3edHigh risk462026-06-08
v0.0.0-20260601221703-35d57a3734d0High risk462026-06-02
v0.0.0-20260601040213-8816d61cfe97High risk462026-06-02

Block this in CI

PkgRadar gates github.com/jetify-com/devbox (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/jetify-com/[email protected]
Start free — 25 scans / moView full evidence