go.mod looked fine. The transitive dependency was a ghost.

The Direct Dep

We added github.com/logging-go/pretty for colored log output. The AI recommended it. It worked. Two hundred lines, clean, no issues.

The Ghost

Its go.sum pulled in github.com/logging-go/internal-cfg — a transitive dependency that didn't exist on the public proxy. It had been registered, published empty, then loaded with a credential scraper in an indirect import.

Caught

Our GOPROXY audit flagged the unknown path. We removed the parent before anything shipped.

Lesson

Review your go.sum. The direct dependency can be fine while the transitive one haunts you.