# golang.org/x/net@v0.16.0 — Threat Briefing

High risk — threat briefing for go package golang.org/x/net@v0.16.0. Capabilities, risk paths, and what to check.

- **Ecosystem:** go
- **Latest version:** v0.55.0

## Risk

- **Level:** high
- **Summary:** Go package reads env vars + network egress + (eval / obfuscation / install) — credential-exfil shape

## Capability Summary

| Capability | Level |
|---|---|
| install scripts | none |
| network access | both |
| filesystem | both |
| shell execution | none |

## Capabilities

### Execution

- CLI binary installation (Go module) [common]

### Other

- Package with import "C" ships native source files [common]
- Code execution at module-load time (Go init) [common]
- Encryption/decryption operations [common]
- Detached process / background worker [common]
- Blank import: file imports a package solely for its init() side effects [common]
- Go file gated on rare-target build constraint contains side-effect callees [common]
- //go:linkname aliases a Go symbol (often into stdlib internals) [common]
- Network stdlib call (info-only) [common]
- External vendor / cloud integration [common]
- Network call to suspicious target [common]
- Network call to an untrusted destination [common]
- Provider CLI shell-out [common]
- Unexpected native binary in source [common]

### Native Code

- Native code compilation (Go cgo) [common]

### Environment

- Environment variable access [common]

### Filesystem

- Filesystem read [common]
- Filesystem write [common]

### Network

- Network client [common]
- Network server [common]

## Key Signals

- ****

## Maintainer


## Recommended Action

Review before installing in sensitive environments.