Unseen in the Stack: Mapping Hidden Java Dependencies for Real-World Defense
Oron Gutman
BSides NYC 2025 (0x05) · Day 1 · Tech - Blue
This talk, presented by Oron Gutman, Co-founder and CTO of Hopper Security, unveils critical research into the pervasive yet often overlooked problem of **shaded and repackaged libraries** within the Java ecosystem. Based on an extensive analysis of real-world Maven repositories and build artifacts, Gutman demonstrates how these hidden dependencies introduce millions of undetectable vulnerabilities into production applications. The core message is stark: traditional Software Composition Analysis (SCA) tools and Software Bill of Materials (SBOMs), which primarily rely on declared dependencies in `pom.xml` files or dependency trees, are fundamentally blind to this issue, leaving organizations exposed to significant and exploitable risks.
AI review
Gutman surfaces a real and underappreciated blind spot in Java SCA tooling — shaded dependencies evading metadata-based scanners — and backs it with actual data from a 16M-artifact Maven Central sweep. The problem is genuine, the numbers are credible, and the auth0/Jackson demo is clean. But this is a BSides NYC slot from a vendor CTO whose company sells exactly the fix being prescribed, which is a conflict you can't ignore, and the core insight (artifact scanners see more than POM parsers) has been floating around the Java security community for years.