Go modules · proxy.golang.org

github.com/lucasew/workspaced

Remote Payload: matched "curl "

Why PkgRadar flagged v0.0.0-20260614184507-16df61d11cc5

Severity	Signal	Evidence
medium	Remote Payload	matched "curl " · github.com/lucasew/[email protected]/cmd/workspaced/selfinstall/root.go

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.0.0-20260614184507-16df61d11cc5`	Review	12	2026-06-15
`v0.0.0-20260614180459-428d9d23820c`	Review	12	2026-06-15
`v0.0.0-20260614175612-1c1fe0f8e1b0`	Review	12	2026-06-15
`v0.0.0-20260614153204-17723bcd655c`	Review	12	2026-06-15
`v0.0.0-20260613165630-6a48dfe17219`	Review	12	2026-06-14
`v0.0.0-20260611194420-43926356de33`	Review	12	2026-06-12
`v0.0.0-20260611145844-cdbec246919e`	Review	12	2026-06-12
`v0.0.0-20260611024007-6a54aa8d9ccf`	Review	12	2026-06-12
`v0.0.0-20260605024305-a5ca80d50ade`	Review	12	2026-06-07
`v0.0.0-20260509195424-cf9ce36c1a95`	Review	12	2026-06-01

Block this in CI

PkgRadar gates github.com/lucasew/workspaced (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/lucasew/[email protected]