Spectra Assure

warningRisk: Vulnerabilities

Scanned:

io.github.bonigarcia:webdrivermanager

Artifact:

latest

Top 1k

Automated driver management and other helper features for Selenium WebDriver in Java

License: Permissive (Apache-2.0)

Published:

See on Maven

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

1 high severity vulnerabilities

Hardening

No application hardening issues

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

Overview issues3 vulnerabilities1 malware0 behaviors114 dependencies0 contributors1 versions106

Popularity

N/A

Total Downloads

Contributor

Declared Dependencies

416

Dependents

Top issues

See all issues

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in Maven community

No prevalence information at this time

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing service URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverage the GitHub service to deliver malicious payloads.

Prevalence in Maven community

No prevalence information at this time

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. Top-level domains (TLD) are a part of the Domain Name System (DNS), and are used to lookup an Internet Protocol (IP) address of a requested website. There are a few different types of top-level domains. Generic, sponsored and country-code TLDs are generally accessible to the public. Registrars that govern the assignment of domain names within the TLD may choose to sell specific domain names to an interested party. However, some registrars are known to have less strict rules for assigning domain names. Attackers often abuse gaps in governance and actively seek to register their malicious domains in such TLDs. This issue is raised for all domains registered within TLDs that harbor an excessive number of malicious sites. While the presence of suspicious TLDs does not imply malicious intent, all of its uses in a software package should be documented and approved.

Prevalence in Maven community

No prevalence information at this time

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the top-level domain to avoid being flagged by security solutions.

Top behaviors

See all behaviors

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Top vulnerabilities

See all vulnerabilities

Vulnerability Exploitation Lifecycle

(1 Active Vulnerabilities)

1 (1 Fixable)

CVE-2026-40542h

None

Exploits Unknown

Exploits Exist

Exploited by Malware

Patching Mandated

FAQ for io.github.bonigarcia:webdrivermanager

What is io.github.bonigarcia:webdrivermanager?

Automated driver management and other helper features for Selenium WebDriver in Java. For more information about this package, visit its homepage.

Is io.github.bonigarcia:webdrivermanager malicious or is it safe to use?

The Java package io.github.bonigarcia:webdrivermanager was scanned for malware, software tampering, risky behaviors, exposed secrets and known vulnerabilities. The package contains risks, and the analysis results should be reviewed before it is downloaded and used. Visit the Issues and Behaviors sections of the analysis for more details.

Is io.github.bonigarcia:webdrivermanager popular?

The Java package io.github.bonigarcia:webdrivermanager ranks among the top 1000 projects in this community. A package's popularity is not a good indicator of its safety, visit the SAFE Assessment section to see the full analysis of package deployment risk categories.

How do I secure io.github.bonigarcia:webdrivermanager once it is in my app?

Since we can't know when or where malicious attacks will happen, we recommend tracking how io.github.bonigarcia:webdrivermanager behaviors change over multiple software releases. By adopting differential analysis in your release process, you can detect unexpected changes to a io.github.bonigarcia:webdrivermanager version, which can prevent advanced software supply chain attacks. Read how our technology can help prevent future attacks similar to SolarWinds and 3CX.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

Popularity

N/A

Total Downloads

Contributor

Declared Dependencies

416

Dependents

Top issues

See all issues

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in Maven community

No prevalence information at this time

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. Top-level domains (TLD) are a part of the Domain Name System (DNS), and are used to lookup an Internet Protocol (IP) address of a requested website. There are a few different types of top-level domains. Generic, sponsored and country-code TLDs are generally accessible to the public. Registrars that govern the assignment of domain names within the TLD may choose to sell specific domain names to an interested party. However, some registrars are known to have less strict rules for assigning domain names. Attackers often abuse gaps in governance and actively seek to register their malicious domains in such TLDs. This issue is raised for all domains registered within TLDs that harbor an excessive number of malicious sites. While the presence of suspicious TLDs does not imply malicious intent, all of its uses in a software package should be documented and approved.

Prevalence in Maven community

No prevalence information at this time

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the top-level domain to avoid being flagged by security solutions.

Top behaviors

See all behaviors

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Top vulnerabilities

See all vulnerabilities

Vulnerability Exploitation Lifecycle

(1 Active Vulnerabilities)

1 (1 Fixable)

CVE-2026-40542h

None

Exploits Unknown

Exploits Exist

Exploited by Malware

Patching Mandated

io.github.bonigarcia:webdrivermanager

SAFE Assessment

Compliance

Security

Threats

Popularity

Top issues

SQ31105Detected presence of high severity vulnerabilities.Causes risk: high severity vulnerabilitiesvulnerabilities

Problem

Prevalence in Maven community

Next steps

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in Maven community

Next steps

TH17118Detected presence of files containing URLs that use suspicious top-level domains.hunting

Problem

Prevalence in Maven community

Next steps

Top behaviors

Starts a PowerShell session and executes specified commands.execution

Prevalence in Maven community

Encodes data using the Base64 algorithm.packer

Prevalence in Maven community

Decodes data using the Base64 algorithm.packer

Prevalence in Maven community

Contains URLs that link to raw files on GitHub.network

Prevalence in Maven community

Encodes data using the Base16 algorithm.file

Prevalence in Maven community

Top vulnerabilities

FAQ for io.github.bonigarcia:webdrivermanager

What is io.github.bonigarcia:webdrivermanager?

Is io.github.bonigarcia:webdrivermanager malicious or is it safe to use?

Is io.github.bonigarcia:webdrivermanager popular?

How do I secure io.github.bonigarcia:webdrivermanager once it is in my app?

Did you know...

Popularity

Top issues

SQ31105Detected presence of high severity vulnerabilities.Causes risk: high severity vulnerabilitiesvulnerabilities

Problem

Prevalence in Maven community

Next steps

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in Maven community

Next steps

TH17118Detected presence of files containing URLs that use suspicious top-level domains.hunting

Problem

Prevalence in Maven community

Next steps

Top behaviors

Starts a PowerShell session and executes specified commands.execution

Prevalence in Maven community

Encodes data using the Base64 algorithm.packer

Prevalence in Maven community

Decodes data using the Base64 algorithm.packer

Prevalence in Maven community

Contains URLs that link to raw files on GitHub.network

Prevalence in Maven community

Encodes data using the Base16 algorithm.file

Prevalence in Maven community

Top vulnerabilities