Maven Central automatically scans Java projects for vulnerabilities (central.sonatype.org)

"Starting this week, we will be scanning all staged repositories on OSSRH automatically as you’re publishing things to Central"