Setup Maven Proxy with DevGuard Dependency Proxy
Maven Central is a target for typosquatting just like npm or PyPI. Attackers publish artifacts under group IDs that look almost like well-known ones, for example org.fasterxml.jackson.core instead of com.fasterxml.jackson.core, and wait for a developer or an automated dependency update to pick the wrong coordinates. Because Maven resolves transitive dependencies and build plugins automatically, a single malicious artifact can end up on every developer machine and CI runner that builds the project.
The DevGuard dependency proxy sits between your build tool and Maven Central. Every artifact request is checked against the OSV dataset before it reaches your local repository, blocking known malicious packages automatically.
- Registry URL:
<your-devguard-url>/api/v1/dependency-proxy/<secret>/maven
Replace <secret> with the dependency proxy secret of your organization, project or repository. The complete proxy URLs are shown in its Dependency Proxy Settings in DevGuard.
Configuration
Maven
Add a mirror to your Maven settings (~/.m2/settings.xml). <mirrorOf>*</mirrorOf> routes every repository through DevGuard, including repositories declared in a project's pom.xml, so no dependency bypasses the check:
Once set, all mvn invocations resolve dependencies and plugins through DevGuard transparently. No changes to your pom.xml are required. In CI, commit the file to your repository and pass it with mvn -s settings.xml.
Gradle
Replace mavenCentral() with the proxy in your settings.gradle.kts:
Testing
DevGuard ships a test artifact, com.fake:malicious-package, that is permanently flagged as malicious for all versions. The script below uses a project-local settings.xml and local repository, so it does not touch your ~/.m2:
If the download is blocked, the proxy is working correctly. Maven reports the 403 Forbidden in its Could not transfer artifact error. All other artifacts resolve normally from Maven Central.
Checksum verification keeps working behind the proxy: Maven downloads the .sha1 and .md5 files of every artifact through DevGuard and verifies them as usual.
Testing the minimum package age
The minimum package age is configured per repository and only applies to requests using the repository's proxy URL, which contains a secret. Maven Central has no publish date API, so the proxy uses the upload time Maven Central reports for each file. Versions that are too new are removed from maven-metadata.xml, and <latest> and <release> point to the newest version that is old enough. Downloads of a too new version are rejected.
To verify it, temporarily set the minimum age to 87600 hours (10 years). com.google.code.gson:gson:2.11.0 was published in May 2024, so the proxy must reject it, while RELEASE still resolves to an older version: