Go modules · proxy.golang.org

github.com/xeeynamo/sotn-decomp/tools/sotn-assets

Remote Payload: matched "github.com/%s/releases/download"

Why PkgRadar flagged v0.0.0-20260612015528-d26850cf6bcd

Severity	Signal	Evidence
medium	Remote Payload	matched "github.com/%s/releases/download" · github.com/xeeynamo/sotn-decomp/tools/[email protected]/deps/setup.go

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.0.0-20260612015528-d26850cf6bcd`	Review	12	2026-06-13
`v0.0.0-20260610234605-d18201930d60`	Review	12	2026-06-12
`v0.0.0-20260610115619-dfa5da84b6c7`	Review	12	2026-06-11
`v0.0.0-20260609230947-5a3574270202`	Review	12	2026-06-11
`v0.0.0-20260609082333-fd97764d440e`	Review	12	2026-06-10
`v0.0.0-20260605232518-361e27ba6a4a`	Review	12	2026-06-07
`v0.0.0-20260605024823-3c2673fd8b4b`	Review	12	2026-06-06
`v0.0.0-20260603042814-c846f0d1c1ec`	Review	12	2026-06-04
`v0.0.0-20260530092318-c471ef575f5c`	Review	12	2026-05-31
`v0.0.0-20260528011718-407535b9b336`	Review	12	2026-05-30
`v0.0.0-20260529083232-2c03c0e205dd`	Review	12	2026-05-30
`v0.0.0-20260528231502-4b814302c37b`	Review	12	2026-05-30

Block this in CI

PkgRadar gates github.com/xeeynamo/sotn-decomp/tools/sotn-assets (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/xeeynamo/sotn-decomp/tools/[email protected]