“Prefix Swap” Panic: Sophisticated “Jackson” Imposter Infiltrates Maven Central

A new report from Aikido Security reveals a highly sophisticated supply chain attack that breached Maven Central with a malicious package masquerading as the Jackson JSON library through a subtle prefix swap. The doppelgänger, identified as org.fasterxml.jackson.core/jackson-databind, swapped the legitimate com[.]fasterxml namespace for attacker-controlled org[.]fasterxml, creating a trap nearly indistinguishable to developers.

The deception extended to the command-and-control infrastructure, with the malware contacting fasterxml[.]org rather than the legitimate fasterxml[.]com. The attackers built a multi-stage payload featuring encrypted configuration strings, a remote command-and-control server delivering platform-specific executables, and multiple layers of obfuscation to hinder analysis, according to the report.

Researchers note the attack is rare in this ecosystem and describe it as novel and the first time they’ve detected rather sophisticated malware on Maven Central, and call for Maven Central to implement prefix similarity detection. The malicious package was removed within 1.5 hours of reporting, illustrating the need for stronger safeguards against such typosquatting in high-value libraries.