Nah, maven is definitely not a modern tool, but it does what it has to. And java’s package situation is in orders of magnitude better health than the critical vulnerability each week js one. Like, maven repo was the only one not affected by that quite big attack last time as well.