Package Health/org.bouncycastle:bcpg-jdk18on

org.bouncycastle:bcpg-jdk18on

The source project has clear ownership, repository tests, and a security policy. The artifact has no install-time scripts and includes signed Maven provenance; reconcile the license text with the registry declaration.

Latest 1.85

Maven

89%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

100

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

License

The artifact includes a license file and the repository also has one, but the detected MIT text does not match the declared Bouncy Castle and Apache licenses. That mismatch warrants clarification despite the package being licensed.

Workflow audit

The only analyzed workflow completed without high-confidence findings and scopes permissions at job level. However, all 3 action references are unpinned, a workflow-hygiene caution because referenced actions can change over time.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-343055 bcpg-jdk18on is vulnerable to Uncontrolled Resource Consumption in versions 1.71.0 - 1.84.0.	1.71.0 - 1.84.0	Medium
AIKIDO-2026-464797 bcpg-jdk18on is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 1.84.0.	0.0.1 - 1.84.0	High
AIKIDO-2026-431029 bcpg-jdk18on is vulnerable to Improper Verification of Cryptographic Signature in versions 1.81.0 - 1.84.0.	1.81.0 - 1.84.0	High
AIKIDO-2026-450423 bcpg-jdk18on is vulnerable to Observable Discrepancy in versions 0.0.1 - 1.84.0.	0.0.1 - 1.84.0	High
AIKIDO-2026-550297 bcpg-jdk18on is vulnerable to Improper Validation of Integrity Check Value in versions 1.74.0 - 1.84.0.	1.74.0 - 1.84.0	High