And with signed artifacts that wouldn't have happened. https://docs.gradle.org/current/userguide/dependency_verification.html#sec:trusting-keys-globally https:

And with signed artifacts that wouldn't have happened. https://docs.gradle.org/current/userguide/dependency_verification.html#sec:trusting-keys-globally https://docs.gradle.org/current/userguide/dependency_verific... > Note that a variation of a compromised library is often name squatting, when a hacker would use GAV coordinates which look legit but are actually different by one character, or repository shadowing, when a dependency with the official GAV coordinates is published in a malicious repository which comes first in your build. Best part is that the documentation literally describes the attack used here. Another example where npm and co are reinventing the same issues that Java has already solved long ago.