PkgRadar

Go modules · proxy.golang.org

github.com/zvec-ai/zvec-go

Remote Payload: matched "github.com/\" + upstreamRepo + \"/releases/download"

Why PkgRadar flagged v0.5.1-0.20260610073045-65ee6577568e

SeveritySignalEvidence
mediumRemote Payloadmatched "github.com/\" + upstreamRepo + \"/releases/download" · github.com/zvec-ai/[email protected]/cmd/download-libs/main.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.5.1-0.20260610073045-65ee6577568eReview122026-06-11
v0.5.0Review122026-06-11

Block this in CI

PkgRadar gates github.com/zvec-ai/zvec-go (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/zvec-ai/[email protected]
github.com/zvec-ai/zvec-go — Go modules security scan | PkgRadar