PkgRadar

Maven · repo1.maven.org

com.google.appengine:appengine-tools-sdk

Java Dynamic Classload: URLClassLoader / defineClass — runs attacker-provided bytecode.

Why PkgRadar flagged 5.0.4

SeveritySignalEvidence
mediumJava Dynamic ClassloadURLClassLoader / defineClass — runs attacker-provided bytecode. · org/apache/tools/ant/AntClassLoader.java
mediumJava Dynamic ClassloadURLClassLoader / defineClass — runs attacker-provided bytecode. · com/google/appengine/repackaged/com/google/common/base/FinalizableReferenceQueue.java
highJava Static Init Side EffectStatic-initializer block contains process/network/reflection — runs on first class load. · org/apache/tools/ant/AntClassLoader.java
highJava Static Init Side EffectStatic-initializer block contains process/network/reflection — runs on first class load. · org/apache/tools/ant/taskdefs/launcher/CommandLauncher.java
highJava Static Init Side EffectStatic-initializer block contains process/network/reflection — runs on first class load. · com/google/appengine/repackaged/com/google/common/base/FinalizableReferenceQueue.java
mediumJava Process SpawnRuntime.exec / ProcessBuilder — process spawning. · org/apache/tools/ant/taskdefs/launcher/CommandLauncher.java
mediumJava Jndi LookupJNDI / Naming.lookup — remote class-loading primitive (Log4Shell family). · com/google/appengine/repackaged/org/eclipse/jetty/util/jndi/NamingDump.java
mediumJava Dynamic ClassloadURLClassLoader / defineClass — runs attacker-provided bytecode. · com/google/appengine/tools/admin/Application.java
mediumJava Unsafe DeserializeObjectInputStream / XStream.fromXML — untrusted deserialization sink. · com/google/appengine/repackaged/org/apache/http/impl/client/BasicAuthCache.java
mediumJava Dynamic ClassloadURLClassLoader / defineClass — runs attacker-provided bytecode. · com/google/apphosting/utils/config/PluginLoader.java
mediumJava Process SpawnRuntime.exec / ProcessBuilder — process spawning. · com/google/appengine/tools/admin/Utility.java
mediumJava Process SpawnRuntime.exec / ProcessBuilder — process spawning. · com/google/appengine/tools/KickStart.java

Scanned versions

VersionVerdictScoreScanned (UTC)
5.0.4Review582026-06-11

Block this in CI

PkgRadar gates com.google.appengine:appengine-tools-sdk (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem maven com.google.appengine:[email protected]