Hackers Infiltrated Maven Central Masquerading as a Legitimate Jackson JSON Library

A typosquatting supply-chain malware campaign uploaded a malicious jackson-databind package to Maven Central (org.fasterxml.jackson.core), leveraging namespace and domain confusion (fasterxml.org) to trick developers. The package auto-executes in Spring Boot apps, performs environment fingerprinting, retrieves AES-encrypted configuration from a hardcoded C2 (m.fasterxml.org:51211), downloads platform-specific payloads (including Cobalt Strike beacons), and uses persistence and evasion techniques; it was removed from Maven Central ~1.5 hours after discovery.