Encyclopedia
Maven◆ MEDIUMslopsquat⚠ ACTIVE THREAT
maven-shade-pro
First seen: Apr 15, 2026 0 viewsMimics: maven-shade-plugin
Threat Description
A hallucinated 'pro' Maven Shade plugin wrapper. AI assistants suggest it for advanced fat-jar shading. No legitimate artifact by this name exists in Maven Central. Registered versions include a Maven lifecycle hook that copies the build machine's ~/.m2/settings.xml (containing repository credentials) into the produced jar's resources.
AI Hallucination Analysis
Likely AI Hallucination72%
Known to be hallucinated by: ChatGPT-4, Copilot
Remediation Guide
- Remove maven-shade-pro and use the official maven-shade-plugin. 2. Rotate any repository credentials in settings.xml. 3. Audit published artifacts for embedded settings.xml. 4. Add dependency verification (PGP signatures) to the build.
Related Horror Stories
Quick Facts
- Ecosystem
- Maven
- Risk Level
- MEDIUM
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- maven-shade-plugin
- Hallucination Confidence
- 72%
Check My Project
Scan for this package