20 June 2026

I scanned real Maven Central packages for supply-chain anomalies. Here's what I found, and where I was wrong

Marshal scored javax.activation:activation ORANGE 55/100 on a real GPG signature drop between versions. Then it embarrassed itself on log4j and commons-collections. Here is the honest account.