Comment Comment by jermo Seems like the Maven registry is susceptible to artifact hijacking.Say I wan't to install artifacts from two GitHub users. I would have to add these two Maven repositories: - https://maven.pkg.github.com/USER1 - https://maven.pkg.github.com/USER2 In that case USER1 can publish an artifact with the same groupId/artifactId as USER2 and my Maven will happily install it without suspecting anything.Another case - someone deletes their GH account and another user takes it: https://blog.sonatype.com/hijacking-of-a-known-github-id-go-...Docs: https://help.github.com/en/articles/configuring-maven-for-us... parent jermo 7 years ago
Say I wan't to install artifacts from two GitHub users. I would have to add these two Maven repositories:
In that case USER1 can publish an artifact with the same groupId/artifactId as USER2 and my Maven will happily install it without suspecting anything.Another case - someone deletes their GH account and another user takes it: https://blog.sonatype.com/hijacking-of-a-known-github-id-go-...
Docs: https://help.github.com/en/articles/configuring-maven-for-us...