PkgRadar

Go modules · proxy.golang.org

golang.org/x/pkgsite

Remote Payload: matched "raw.githubusercontent.com"

Why PkgRadar flagged v0.0.0-20260605201217-deb78785c3ce

SeveritySignalEvidence
mediumRemote Payloadmatched "raw.githubusercontent.com" · golang.org/x/[email protected]/devtools/cmd/css/main.go
mediumRemote Payloadmatched "curl " · golang.org/x/[email protected]/internal/licenses/exceptions.gen.go
mediumRemote Payloadmatched "cURL " · golang.org/x/[email protected]/internal/middleware/godocredirect.go

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.0.0-20260605201217-deb78785c3ceHigh risk362026-06-06
v0.1.1-0.20260605201217-deb78785c3ceHigh risk362026-06-06
v0.1.1-0.20260605141245-7b2d95261b4fHigh risk362026-06-06
v0.0.0-20260605141245-7b2d95261b4fHigh risk362026-06-06
v0.1.0High risk362026-06-05
v0.0.0-20260529211409-b045357bb4e9Review362026-05-30

Block this in CI

PkgRadar gates golang.org/x/pkgsite (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go golang.org/x/[email protected]
Start free — 25 scans / moView full evidence