cyber.hendryadrian.com
Security News · stepsecurity.io

StepSecurity Adds Maven Support to GitHub Checks and OSS Package Search

· Original article ↗

Summary

StepSecurity says Maven support is now available in GitHub Checks and OSS Package Search, adding compromised-package and publication-cooldown checks plus dependency location across pull requests, branches, and developer machines. Registry and device coverage are planned

Key points

  • StepSecurity has added Maven to GitHub Checks and OSS Package Search, alongside npm and PyPI.
  • Maven Package Compromised Updates can block pull requests that add or update dependencies listed in StepSecurity’s compromised-packages database; the company says its SOC maintains the database in real time.
  • Maven Package Cooldown can block recently published versions until they pass a configurable waiting period. Both controls can be required or advisory, and an existing override can approve urgent changes.
  • OSS Package Search can locate a specific Maven package and version across pull requests, default branches, and developer machines, and export results to CSV.
  • Maven support for Secure Registry and Dev Machine Guard is planned, not yet available.
  • The post cites a compromised npm package mirrored to Maven Central and a malicious Jackson lookalike reportedly used to deliver Cobalt Strike as examples of Java supply-chain risks.

Article Details

Event Type
StepSecurity launched Maven support in GitHub Checks and OSS Package Search, adding compromised-package and package-cooldown controls for Maven dependencies and search across repositories and developer machines.
Impact
The controls can block pull requests that introduce flagged or recently published Maven versions, while OSS Package Search helps identify where a specific package and version appears to support remediation. The article says Maven support for Secure Registry and Dev Machine Guard is planned, not yet launched.

Malware

Shai-HuludWhen the Shai-Hulud worm came back for its second wave, it did not stay in npm. The same payload that hit PostHog's npm packages also surfaced on Maven Central, where an automated process that re-publishes npm modules

Vendors

StepSecurityUntil now, StepSecurity customers could close that window for npm and PyPI but not for Maven. Today that changes.

Products

GitHub ChecksMaven support is launching in GitHub Checks and OSS Package Search first. Two more pieces are on the way:OSS Package Searchyou can immediately answer the only question that matters during an incident: where is it. OSS Package Search finds every place a specific Maven package and version appears across your pull requests, defaultStepSecurity Dev Machine GuardDev Machine Guard will add Maven coverage on developer machines, so Java dependencies can be inventoried and audited across your fleet alongside npm and PyPI.StepSecurity Secure RegistrySecure Registry will add Maven so that compromised and freshly published Java packages can be blocked at install time, the same way npm and PyPI already are. This extends the cooldown and compromised-package controls

Tools

Cobalt Strikeinto Maven Central, using namespace impersonation and a multi-stage, obfuscated payload to deliver Cobalt Strike to anyone who pulled the wrong coordinate. The Java ecosystem is squarely in scope.

Related Articles