Maybe parsing the `go.mod`/`go.sum` or gopkg? Maybe talking to GOPROXY API? https://golang.org/cmd/go/#hdr-Module_proxy_protocol