Go modules · proxy.golang.org

github.com/tokiwa-software/fuzion

Remote Payload: matched "wget "

Why PkgRadar flagged v0.0.0-20260526074707-82fa737eff28

Severity	Signal	Evidence
medium	Remote Payload	matched "wget " · github.com/tokiwa-software/[email protected]/bin/windows_install_boehm_gc.sh

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.0.0-20260612131630-25a9209f64f0`	Low risk	0	2026-06-14
`v0.0.0-20260611114459-7935358ec8b7`	Low risk	0	2026-06-13
`v0.0.0-20260610153203-101adae8b404`	Low risk	0	2026-06-11
`v0.0.0-20260605072611-3b432a35e2d1`	Low risk	0	2026-06-07
`v0.0.0-20260529090410-e47bf8e1569e`	Low risk	0	2026-05-31
`v0.0.0-20260526074707-82fa737eff28`	Review	12	2026-05-29

Block this in CI

PkgRadar gates github.com/tokiwa-software/fuzion (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/tokiwa-software/[email protected]