@joshlong.bsky.social Wrote up a supply-chain finding: a GPG signature drop in javax.activation that looks exactly like an account takeover, and looking at a routine handoff using only Maven Central metadata. Relevant for Spring Boot teams running Renovate auto-merge. foojay.io/today/this-d...

This Dependency Update Looked Exactly Like an Account Takeover - foojay

I pointed a scanner I have been building at an old Spring project, and it flagged javax.activation. The bump was 1.1-rev-1 to 1.1.1. Prior releases - by Muhammad Usman

foojay.io

When a routine dependency update triggers all the red flags of a security breach. @marshalhq.bsky.social breaks down what happened and why it looked so suspicious. foojay.io/today/this-d... #Java #Security #Dependencies

This Dependency Update Looked Exactly Like an Account Takeover - foojay

I pointed a scanner I have been building at an old Spring project, and it flagged javax.activation. The bump was 1.1-rev-1 to 1.1.1. Prior releases - by Muhammad Usman

foojay.io

Gradle support shipped. Marshal now checks what Gradle actually resolves, not what the build file claims. A version that looks pinned but quietly resolves to something else is exactly where a swapped dependency hides. Now caught on Maven and Gradle both. #java #appsec

Shipped Marshal v0.1 today. It scores Maven dependency updates on behavioral signals. The clearest one: a package that used to ship a GPG signature and suddenly doesn't. That's often the first sign of a hijacked publisher, and it lands before any CVE exists. github.com/marshal-hq/marshal

GitHub - marshal-hq/marshal: Behavioral security monitoring for JVM dependencies. Catches malicious package updates before CVEs exist

Behavioral security monitoring for JVM dependencies. Catches malicious package updates before CVEs exist - marshal-hq/marshal

github.com

I ran my supply-chain scanner against real Maven Central packages this week. One real finding. Two false positives I had to cut rather than fake a clean demo. Wrote it up with the actual GPG fingerprints: dev.to/usman18/i-sc...

I scanned real Maven Central packages for supply-chain anomalies. Here's what I found, and where I was wrong

I'm building Marshal, a behavioral supply-chain scanner for JVM dependencies. Instead of waiting for...

dev.to

Week 3 of building Marshal. GitHub Action scans real PRs against Maven Central. Three dep updates on a Spring Boot project, all 0/100. If a maintainer gets hijacked and pushes a bad version, this check blocks it. github.com/marshal-hq/marshal

Week 2 of building Marshal in public. The detection engine works. Took 5 real supply chain attacks from the last 8 years and ran them through it. 3 flagged RED. 1 YELLOW. 1 only partially caught. The partial one is the interesting one.

Where regulated teams live and nobody else is looking. Solo founder, Tilburg. 10 years of Java. Shipping v0.1 in 30 days. Building in public. If you auto-merge Renovate or Dependabot PRs without watching behavioral signals, this is the gap. marshalhq.dev

I'm building Marshal. It watches how packages change — maintainer swaps, new install hooks, dependency injections, obfuscated code — and blocks risky updates at PR time. Starting with Maven Central. JVM-first.

The signals were there before any CVE. New maintainer account activity. Malicious postinstall hook added. New dependency injected. Network calls in install scripts. Behavioral signals. Not CVE scores.

This is the pattern every time. Attacker hijacks a maintainer account. Publishes a malicious version. Millions of auto-updates pull it within hours. CVE filed days or weeks later. By the time your scanner fires, you're already breached.

In March 2026, a North Korean hacker compromised one axios maintainer account. Axios has 100 million weekly downloads. Every CVE scanner missed it. No CVE existed yet. A postinstall hook was silently installing a RAT on developer machines.