PkgRadar

Go modules · proxy.golang.org

github.com/throneproj/sing-box

Remote Payload: matched "cURL "

Why PkgRadar flagged v1.11.16-0.20260605124916-ceec0e7b9f10

SeveritySignalEvidence
mediumRemote Payloadmatched "cURL " · github.com/throneproj/[email protected]/adapter/tailscale.go
mediumRemote Payloadmatched "cURL " · github.com/throneproj/[email protected]/common/httpclient/apple_transport_darwin.go
mediumRemote Payloadmatched "cURL " · github.com/throneproj/[email protected]/daemon/started_service.pb.go
mediumRemote Payloadmatched "cURL " · github.com/throneproj/[email protected]/experimental/libbox/command_types_tailscale.go
mediumRemote Payloadmatched "cURL " · github.com/throneproj/[email protected]/protocol/tailscale/status.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v1.11.16-0.20260605171458-8beda93f62aeLow risk02026-06-06
v1.11.16-0.20260605130317-0d2b84c01725Low risk02026-06-06
v1.11.16-0.20260605124916-ceec0e7b9f10High risk502026-06-06
v1.11.16-0.20260531155042-90f9ec606d49Low risk02026-06-01
v1.11.16-0.20260531101438-c49adb914adeLow risk02026-06-01

Block this in CI

PkgRadar gates github.com/throneproj/sing-box (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/throneproj/[email protected]