MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries

Oversecured disclosed "MavenGate", a supply-chain attack that leverages ownership of expired reversed domains and vulnerable repository groupId management to hijack Maven/Gradle dependencies and inject malicious code into Java and Android builds; a proof-of-concept showed 6,170 of 33,938 domains were vulnerable, and Sonatype has applied mitigations and improved validation procedures.