4 ms·

> Says Only Development Community Where This Regularly Happens We've had such issues on other places as well... Shai-Hulud got into Maven [1] and PHP Composer

> Says Only Development Community Where This Regularly Happens We've had such issues on other places as well... Shai-Hulud got into Maven [1] and PHP Composer [2], typosquatters got into Maven [3], and it's not new either [4]. No one is safe from skiddies, much less from nation state actors. [1] https://thehackernews.com/2025/11/shai-hulud-v2-campaign-spreads-from-npm.html https://thehackernews.com/2025/11/shai-hulud-v2-campaign-spr... [2] https://semgrep.dev/blog/2026/malicious-intercom-php-package-spreads-mini-shai-hulud-attack-to-packagist-via-composer-plugin/ https://semgrep.dev/blog/2026/malicious-intercom-php-package... [3] https://www.esecurityplanet.com/threats/malicious-jackson-lookalike-library-slips-into-maven-central/ https://www.esecurityplanet.com/threats/malicious-jackson-lo... [4] https://socket.dev/blog/malicious-maven-package-exfiltrates-oauth-credentials https://socket.dev/blog/malicious-maven-package-exfiltrates-...

gred 5mo ago
Your example of security issues in Maven is... npm guys setting up processes to auto-publish infected npm packages into the Maven Central repository? Wake me up when the daily npm security breach headlines are typosquatting stories, not RCE-on-build or RCE-on-upgrade.
- mschuster91 5mo ago
  > Wake me up when the daily npm security breach headlines are typosquatting stories, not RCE-on-build or RCE-on-upgrade. RCE-on-build/upgrade can be done in Maven if you manage to compromise one of the major Maven plugins, they run at build time. The thing keeping maven safe for now is that most people pin the plugin and dependency versions, with the obvious side effect that it's truly annoying to get all your dependencies updated.
  - gred 5mo ago
    > The thing keeping maven safe for now is that most people pin [...] versions Yes, and also the signing of JARs that are uploaded to the repository, and the fact that most release processes are not fully automated, and the batteries-included standard library which reduces the total number of dependencies, and the fact that a run-of-the-mill third-party library can't execute code at build time, and the very small number of people with credentials to publish new versions of major Maven plugins, etc.

gred 5mo ago

Your example of security issues in Maven is... npm guys setting up processes to auto-publish infected npm packages into the Maven Central repository? Wake me up when the daily npm security breach headlines are typosquatting stories, not RCE-on-build or RCE-on-upgrade.

mschuster91 5mo ago
> Wake me up when the daily npm security breach headlines are typosquatting stories, not RCE-on-build or RCE-on-upgrade. RCE-on-build/upgrade can be done in Maven if you manage to compromise one of the major Maven plugins, they run at build time. The thing keeping maven safe for now is that most people pin the plugin and dependency versions, with the obvious side effect that it's truly annoying to get all your dependencies updated.
- gred 5mo ago
  > The thing keeping maven safe for now is that most people pin [...] versions Yes, and also the signing of JARs that are uploaded to the repository, and the fact that most release processes are not fully automated, and the batteries-included standard library which reduces the total number of dependencies, and the fact that a run-of-the-mill third-party library can't execute code at build time, and the very small number of people with credentials to publish new versions of major Maven plugins, etc.