Go modules · proxy.golang.org
github.com/mesh-intelligence/mage-claude-orchestrator
Go Init Env Token Exfil: Go init() reads CI / npm / cloud env tokens AND has network/exec on the same scope — canonical credential-exfil shape.
Why PkgRadar flagged v0.20260612.0
| Severity | Signal | Evidence |
|---|---|---|
| high | Go Init Env Token Exfil | Go init() reads CI / npm / cloud env tokens AND has network/exec on the same scope — canonical credential-exfil shape. · github.com/mesh-intelligence/[email protected]/pkg/orchestrator/commands.go |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
v0.20260612.0 | High risk | 45 | 2026-06-14 |
v0.20260612.1 | High risk | 45 | 2026-06-14 |
v0.20260530.0 | High risk | 45 | 2026-06-01 |
v0.20260530.1 | High risk | 45 | 2026-06-01 |
Block this in CI
pkgradar gate --ecosystem go github.com/mesh-intelligence/[email protected]