stepsecurity.ioarticleMaven Support Comes to GitHub Checks and OSS Package Search
StepSecurity extends its GitHub Checks and OSS Package Search products to cover Maven Central, adding "Maven Package Compromised Updates" and "Maven Package Cooldown" PR checks alongside existing npm/PyPI controls. The post cites two real incidents motivating the launch: the Shai-Hulud worm's second wave reaching Maven Central through an automated npm-to-Maven republishing pipeline, and a malicious namespace-impersonating lookalike of the Jackson JSON library that used an obfuscated multi-stage payload to deliver Cobalt Strike. Secure Registry and Dev Machine Guard Maven support are announced as coming next.
TL;DR StepSecurity adds Maven Central coverage (compromised-package blocking, cooldown windows, package search) to its GitHub Checks/OSS Package Search after Shai-Hulud and a Jackson-impersonating malware package hit Java's supply chain.
Technologies named here
- StepSecurity GitHub Checks
- Maven Central
- Maven Package Compromised Updates
- npm
- Maven Package Cooldown
- Jackson JSON library
- OSS Package Search
- PostHog npm packages
- Secure Registry
- Dev Machine Guard
- Cobalt Strike
- Harden-Runner
- Maven
- StepSecurity
- GitHub Checks
- Jackson
Techniques named here
- Software supply chain compromise via package registry
- Namespace impersonation
- Multi-stage obfuscated payload delivery
- Automated cross-ecosystem re-publishing abuse
- Transitive dependency exploitation
Threat actors named here
- Shai-Hulud
- Malicious Jackson lookalike campaign
Related in Supply Chain
