  We introduce Java-Class-Hijack, a novel software supply chain attack that
enables an attacker to inject malicious code by crafting a class that shadows a
legitimate class that is in the dependency tree. We describe the attack,
provide a proof-of-concept demonstrating its feasibility, and replicate it in
the German Corona-Warn-App server application. The proof-of-concept illustrates
how a transitive dependency deep within the dependency tree can hijack a class
from a direct dependency and entirely alter its behavior, posing a significant
security risk to Java applications. The replication on the Corona-Warn-App
demonstrates how compromising a small JSON validation library could result in a
complete database takeover.
