PkgRadar

Go modules · proxy.golang.org

github.com/xtls/xray-core

Remote Payload: matched "raw.githubusercontent.com"

Why PkgRadar flagged v1.8.5-0.20231112205209-a109389efb17

SeveritySignalEvidence
mediumRemote Payloadmatched "raw.githubusercontent.com" · github.com/xtls/[email protected]/infra/vprotogen/main.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v1.8.5-0.20231112205209-a109389efb17Review122026-06-16
v0.0.0-20260609205355-da21a8f77f31Low risk02026-06-12
v1.260327.1-0.20260609205355-da21a8f77f31Low risk02026-06-11
v1.260327.1-0.20260609155802-e10347bf01f2Low risk02026-06-10
v1.260327.1-0.20260605221154-87c08d0d7af4Low risk02026-06-07
v1.260327.1-0.20260602235856-fdb9b616fc0eLow risk02026-06-04
v0.0.0-20251208133516-81f8f398c7b2Low risk02026-06-02
v0.0.0-20260601021109-94ffd50060f1Low risk02026-06-02
v1.260327.1-0.20260528182027-fa466f81746bLow risk02026-06-02
v1.260327.1-0.20260601021109-94ffd50060f1Low risk02026-06-02
v1.260327.1-0.20260530172933-455f6bc2d591Low risk02026-05-31
v1.260327.1-0.20260530093023-ba538619eb8aLow risk02026-05-31
v1.260327.1-0.20260529150459-d43a808ea502Low risk02026-05-30
v1.260327.1-0.20260528201538-4dcf802ae3a7Low risk02026-05-29
v1.260327.1-0.20260528142257-e26f5e95487aLow risk02026-05-29

Block this in CI

PkgRadar gates github.com/xtls/xray-core (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/xtls/[email protected]
Start free — 25 scans / moView full evidence