Java devs aren't safe either: a hallucinated Maven dependency shipped ransomware

The Coordinates

com.fasterxml.xml.utils — the AI suggested it for XML binding. Looked like it belonged to the Jackson family. It did not.

The Payload

The JAR ran an initializer that encrypted the user's home directory on first load. Ransom note on the desktop. 0.3 BTC.

Who

A junior dev on a Spring Boot side project. They paid. We don't know if they recovered the files.

Lesson

Maven coordinates mimic Java's package conventions exactly. com.fasterxml.xml.utils sounds like a real Jackson module. It wasn't. Verify the groupId against the publisher's docs.