That’s pretty interesting, but it’s also unfortunate for the people who got infected. Maybe requiring the JAR files to be signed by the authors help mitigate this type of attack.