5 ms·
Wouldn't this also be a problem for Go, which just imports from URLs (mostly GitHub) as well?
by simantel 1y ago
Wouldn't this also be a problem for Go, which just imports from URLs (mostly GitHub) as well?
- deleted 1y ago[deleted]
- jitl 1y agoThe go imports use a Google-owned proxy for resolution which has a vulnerability facility. All golang package installs use the Google-owned proxy unless you set GOPROXY=direct when running go commands. https://arc.net/l/quote/arrozgok https://arc.net/l/quote/arrozgok