p3rspective

5 ms·

1. 1.▲
   by p3rspective 10mo ago

   generally yes, although hijacking can and has happened on Central with expired maintainer domains reclaimed by threat actor who can then republish malicious versions of a previously legit group/artifact ID. there's also the proble
2. 2.▲
   by p3rspective 10mo ago

   Make no mistake, Maven Central does get multiple malware components uploaded each year, though not nearly to the same extent as npm or pypi. Sonatype (my former employer) just doesn't report on these publicly each time it happens. It&#