PkgRadar

Go modules · proxy.golang.org

github.com/justwasm/crush

Go Generate Shell: //go:generate directive shells out to curl/wget/bash — runs during `go generate`.

Why PkgRadar flagged v0.34.0

SeveritySignalEvidence
mediumGo Generate Shell//go:generate directive shells out to curl/wget/bash — runs during `go generate`. · github.com/justwasm/[email protected]/internal/agent/hyper/provider.go
mediumRemote Payloadmatched "curl " · github.com/justwasm/[email protected]/internal/cmd/run.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.34.0Review322026-06-17
v0.47.0Review322026-06-17
v0.25.0Review172026-06-17
v0.27.0Review322026-06-17
v0.4.0Review52026-06-17
v0.1.11Review52026-06-17
v0.9.0Review52026-06-17
v0.13.2Review52026-06-17
v0.53.0Review322026-06-17
v0.57.0Review322026-06-17
v0.42.0Review322026-06-17
v0.12.2Review52026-06-17
v0.19.1Review172026-06-17
v0.21.0Review172026-06-17
v0.1.10Review52026-06-17
v0.1.7Review52026-06-17
v0.30.3Review322026-06-17
v0.19.3Review172026-06-17
v0.1.9Review52026-06-17
v0.41.0Review322026-06-17
v0.13.6Review52026-06-17
v0.5.0Review52026-06-17
v0.18.1Review172026-06-17
v0.56.0Review322026-06-17
v0.39.2Review322026-06-17
v0.65.2Review322026-06-17
v0.6.2Review52026-06-17
v0.23.0Review172026-06-17
v0.24.0Review172026-06-17
v0.33.0Review322026-06-17
v0.43.3Review322026-06-17
v0.15.2Review172026-06-17
v0.10.2Review52026-06-17
v0.20.0Review172026-06-17
v0.7.4Review52026-06-17
v0.50.1Review322026-06-17
v0.10.0Review52026-06-17
v0.8.3Review52026-06-17
v0.6.0Review52026-06-17
v0.8.0Review52026-06-17
v0.33.1Review322026-06-17
v0.52.0Review322026-06-17
v0.18.2Review172026-06-17
v0.3.0Review52026-06-17
v0.40.0Review322026-06-17
v0.13.0-beta.2Review52026-06-17
v0.7.3Review52026-06-17
v0.8.1Review52026-06-17
v0.9.2Review52026-06-17
v0.9.3Review52026-06-17
v0.50.0Review322026-06-17
v0.1.3Review52026-06-17
v0.7.0Review52026-06-17
v0.43.4Review322026-06-17
v0.2.2Review52026-06-17
v0.7.5Review52026-06-17
v0.45.0Review322026-06-17
v0.12.3Review52026-06-17
v0.15.0Review172026-06-17
v0.36.0Review322026-06-17
v0.65.0Review322026-06-17
v0.62.1Review322026-06-17
v0.55.1Review322026-06-17
v0.14.0Review172026-06-17
v0.18.4Review172026-06-17
v0.10.1Review52026-06-17
v0.44.0Review322026-06-17
v0.7.9Review52026-06-17
v0.45.1Review322026-06-17
v0.2.1Review52026-06-17
v0.11.2Review52026-06-17
v0.1.0Review52026-06-17
v0.7.1Review52026-06-17
v0.58.0Review322026-06-17
v0.12.1Review52026-06-17
v0.13.3Review52026-06-17
v0.51.3Review322026-06-17
v0.63.0Review322026-06-17
v0.30.0Review322026-06-17
v0.29.0Review322026-06-17
v0.46.1Review322026-06-17
v0.47.2Review322026-06-17
v0.13.7Review52026-06-17
v0.17.0Review172026-06-17
v0.13.4Review52026-06-17
v0.16.1Review172026-06-17
v0.47.1Review322026-06-17
v0.35.0Review322026-06-17
v0.19.2Review172026-06-17
v0.19.4Review172026-06-17
v0.7.6Review52026-06-17
v0.62.0Review322026-06-17
v0.32.0Review322026-06-17
v0.46.2Review322026-06-17
v0.66.1-0.20260605062412-2d3d07d562d2Review322026-06-17
v0.22.2Review172026-06-17

Block this in CI

PkgRadar gates github.com/justwasm/crush (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/justwasm/[email protected]
Start free — 25 scans / moView full evidence