Maven · repo1.maven.org

org.paramixel:core

Java Static Init Side Effect: Static-initializer block contains process/network/reflection — runs on first class load.

Why PkgRadar flagged 6.2.0

Severity	Signal	Evidence
high	Java Static Init Side Effect	Static-initializer block contains process/network/reflection — runs on first class load. · nonapi/org/paramixel/classgraph/nonapi/io/github/classgraph/classpath/ClasspathOrder.java
medium	Java Dynamic Classload	URLClassLoader / defineClass — runs attacker-provided bytecode. · nonapi/org/paramixel/classgraph/io/github/classgraph/ClassGraphClassLoader.java
medium	Java Process Spawn	Runtime.exec / ProcessBuilder — process spawning. · nonapi/org/paramixel/support/TildePathExpander.java

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`6.2.0`	High risk	70	2026-06-13

Block this in CI

PkgRadar gates org.paramixel:core (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem maven org.paramixel:[email protected]