# Detecting Maven-Hijack-style risks in Gradle builds with the Dependency Analysis Gradle Plugin

DevFeed: [Detecting Maven-Hijack-style risks in Gradle builds with the Dependency Analysis Gradle Plugin](<https://devfeed.tech/articles/detecting-maven-hijack-style-risks-in-gradle-builds-with-the-dependency-analysis-gradle-plugin-24611.md>)

Original publisher: [Read original article](<https://blog.gradle.org/detect-maven-hijack-risks-in-gradle-with-plugin>)

Author: Laura Kassovic

Published: 2025-12-08T05:00:00Z

Content type: tutorial

Language: en

Sources: [The Gradle Blog](<https://devfeed.tech/sources/the-gradle-blog.md>)

Topics: [Gradle](<https://devfeed.tech/topics/gradle.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [software supply-chain attack](<https://devfeed.tech/topics/software-supply-chain-attack.md>), [Java](<https://devfeed.tech/topics/java.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [dependency](<https://devfeed.tech/tags/dependency.md>), [gradle](<https://devfeed.tech/tags/gradle.md>), [gradle-plugin](<https://devfeed.tech/tags/gradle-plugin.md>), [java](<https://devfeed.tech/tags/java.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [software-supply-chain-attack](<https://devfeed.tech/tags/software-supply-chain-attack.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

This tutorial explains how Maven-Hijack-style attacks exploit duplicate fully qualified class names, deterministic Maven packaging order, and JVM classloader behavior in Java builds. It presents DAGP 3.5.0, the Dependency Analysis Gradle Plugin, as a defense that warns about duplicate classes and checks binary compatibility to identify potentially ambiguous bytecode.

## Source excerpt

JVM builds have lived with "duplicate classes on the classpath" for years. Most of the time, it's an annoying source of NoSuchMethodError or a "why did production suddenly break when I reordered dependencies?" kind of bug. A recent academic paper, Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order, shows that this isn't just a reliability problem, it's also a supply-chain security problem. DAGP 3.5.0 (Dependency Analysis Gradle Plugin), a popular community plugin, now provides another line of defense: in addition to warning you about duplicate classes, it checks binary compatibility when it finds them. That means it can spot cases where "the same class name" actually refers to different bytecode, which is exactly the kind of ambiguity Maven-Hijack exploits. We'll explore how to use DAGP to protect against Maven-Hijack style attacks in Gradle builds. If you've heard about supply chain vulnerabilities in the npm / Nx ecosystem, we've also written about how Continuous GRC can help block compromised packages across your org. What Maven-Hijack actually does The Maven-Hijack paper describes a class of attacks that rely on two facts about the Java ecosystem: Maven packaging order is deterministic - When building an uber-JAR, Maven walks the dependency tree in depth-first order and packages classes in that order. Dependencies earlier in that traversal "win" when there are duplicates. The JVM classloader loads the first matching class on the classpath - At runtime, the Java classloader linearly scans the classpath and loads the first class whose fully-qualified name matches the one being requested. That's enough to build an attack: The attacker finds a gadget dependency, a library that contains a class they'd love to hijack (e.g., a JDBC driver or some other central integration point). They then compromise or control an infection dependency that appears earlier in the dependency tree and publish a new version that contains a class with the same fully quali