Java Open-Source Supply-Chain Review
Java repository pattern findings, supply-chain review signals and scan coverage.
Report generated: 2026-11-14 17:29 UTC.
Primary repository language: Java. 304 successful scans; 304 with a score, positive coverage and complete version metadata. Mean values are grouped by version; individual scores below are review prompts, not confirmed package incidents.
| Language | Scanned repos | Repos scored | Mean index / 100 | Schema / engine / scoring |
|---|---|---|---|---|
| Java | 304 | 304 | 9.38 | 1.0.0 / 2.0.0 / heuristic-density-v1 |
Repository evidence
| Repository | Supply-chain index / 100 | Schema / engine / scoring | Lines scanned | Scan date |
|---|---|---|---|---|
| javaparser/javaparser | 100.00 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 380,956 | 2026-10-31 |
| HMCL-dev/HMCL | 97.03 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 213,948 | 2026-10-31 |
| PaperMC/Paper | 69.19 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 359,527 | 2026-10-31 |
| projectlombok/lombok | 61.50 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 143,016 | 2026-10-31 |
| swagger-api/swagger-core | 61.46 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 127,134 | 2026-10-31 |
| alibaba/ARouter | 59.47 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 21,179 | 2026-10-31 |
| apache/hive | 57.67 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 2,621,262 | 2026-10-31 |
| ReChronoRain/HyperCeiler | 51.75 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 390,693 | 2026-10-31 |
| INRIA/spoon | 50.06 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 287,757 | 2026-10-31 |
| deeplearning4j/deeplearning4j | 44.95 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 1,250,322 | 2026-10-31 |
| oracle/graal | 43.89 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 3,745,384 | 2026-10-31 |
| apache/zeppelin | 43.70 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 475,720 | 2026-10-31 |
| grpc/grpc-java | 42.46 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 441,771 | 2026-10-31 |
| ageerle/ruoyi-ai | 38.57 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 173,058 | 2026-10-31 |
| apache/sedona | 37.73 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 446,925 | 2026-10-31 |
| apache/flink-cdc | 35.97 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 487,345 | 2026-10-31 |
| google/auto | 35.08 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 68,292 | 2026-10-31 |
| apache/drill | 34.98 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 996,337 | 2026-10-31 |
| power721/alist-tvbox | 33.85 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 269,912 | 2026-10-31 |
| Atmosphere/atmosphere | 33.20 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 784,766 | 2026-10-31 |
| alibaba/canal | 32.05 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 152,168 | 2026-10-31 |
| apache/fluss | 31.51 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 880,806 | 2026-10-31 |
| alibaba/arthas | 31.12 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 195,967 | 2026-10-31 |
| apache/shenyu | 28.58 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 690,809 | 2026-10-31 |
| JSQLParser/JSqlParser | 27.49 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 214,592 | 2026-10-31 |
Pattern signals are prompts for human review, not proof of AI authorship, security vulnerabilities, missing packages, measured review time or code quality. Selection, scan coverage and scoring versions limit comparisons.