Maven · repo1.maven.org

cn.xnatural:tiny

Java Base64 Combo: Base64.decode combined with network / process / defineClass — classic obfuscated payload.

Why PkgRadar flagged 3.0.test4

Severity	Signal	Evidence
high	Java Base64 Combo	Base64.decode combined with network / process / defineClass — classic obfuscated payload. · cn/xnatural/Util.java
medium	Java Process Spawn	Runtime.exec / ProcessBuilder — process spawning. · cn/xnatural/Util.java

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`3.0.test4`	High risk	22	2026-06-11
`3.0.test3`	High risk	45	2026-06-10
`3.0.test2`	High risk	22	2026-06-10

Block this in CI

PkgRadar gates cn.xnatural:tiny (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem maven cn.xnatural:[email protected]