Maven · repo1.maven.org

vn.io.lcx:common-lib

Java Static Init Side Effect: Static-initializer block contains process/network/reflection — runs on first class load.

Why PkgRadar flagged 4.1.0.lcx

Severity	Signal	Evidence
high	Java Static Init Side Effect	Static-initializer block contains process/network/reflection — runs on first class load. · vn/io/lcx/common/utils/HttpUtils.java
medium	Java Unsafe Deserialize	ObjectInputStream / XStream.fromXML — untrusted deserialization sink. · vn/io/lcx/common/utils/SerializeUtils.java
medium	Java Process Spawn	Runtime.exec / ProcessBuilder — process spawning. · vn/io/lcx/common/utils/ShellCommandRunningUtils.java

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`4.1.0.lcx`	High risk	70	2026-06-12

Block this in CI

PkgRadar gates vn.io.lcx:common-lib (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem maven vn.io.lcx:[email protected]