frohoff / ysoserial
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
- Stars
- 9,100 stars
- Forks
- 1,850 forks
- Language
- Java
- License
- MIT
- Created
- Jan 28, 2015
- Last push
- Dec 4, 2025
- Updated
- Nov 11, 2026
Why these Tags: an agent read the README and quoted it
- Penetration testing from the description:
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
An agent gave these Tags from the fixed Tag list in the AwesomeRepos source code. A code check kept each Tag only when its quote is in the text. A wrong Tag? Report an error with the form at the end of this page.
Admitted to the Repository Index on Nov 10, 2026: 9,096 stars on 2026-11-10.
Star History
186 days recorded, May 10, 2026 – Nov 11, 2026 (UTC). Net change +279 stars.
The star count of each day is the latest count minus the net stars of the later days.
Add this Star History to a README
The images follow the light or dark theme of the page that shows them, and update every hour.
Add ?theme=light or ?theme=dark
to the chart address to keep one theme.
Star History chart
[](https://awesomerepos.com/frohoff/ysoserial) Badge
[](https://awesomerepos.com/frohoff/ysoserial) Timeline
It gained stars on 140 of the 186 days recorded since May 10, 2026.
Its largest 7 days were Jul 8, 2026 to Jul 14, 2026: 23 stars.
In the 30 days to Nov 11, 2026 it got 32 stars, 30% fewer than in the 30 days before.
It had 8,821 stars before May 10, 2026 and has 9,100 stars now: 900 fewer than 10,000.
- Created on the Repository Host
- Release v0.0.6
- Latest push
- +5 stars in one day
- +5 stars in one day
- Largest star day recorded: +7 stars
- Entered the Repository Index: 9,096 stars on 2026-11-10
The timeline comes from the creation date and the releases on the Repository Host, the Admission, the Star History, and the Observations. Star milestones show only when the Star History records the day. The list shows up to 5 stable releases from the latest 10 releases recorded. When none of them is stable, one item counts the pre-releases. On the chart of net stars each day, a solid line marks each recorded release.
Forks and pushes
From 2 Observations, Nov 11, 2026 – Nov 12, 2026. Forks 0. AwesomeRepos saw a new push on 0 of 1 days.
- Nov 12, 2026: no new push
A filled day: the last push time changed since the Observation before it.
Health facts
Measured facts in four separate dimensions, each with a date and a source. AwesomeRepos does not add them into one score. AwesomeRepos reads the weekly commits, the changelog, and the community files each week for the 5,000 visible repositories with the most stars and for each rising repository. How AwesomeRepos defines each check
Copies a prompt for a coding agent. It has 1 task for the maintainers of frohoff/ysoserial.
Improve the Health Facts of the GitHub repository frohoff/ysoserial. AwesomeRepos measures facts about how a repository is maintained, released, secured, and documented. Its page for this repository is https://awesomerepos.com/frohoff/ysoserial. A change to the repository can improve each of the item below. Each item gives the measured fact or score, and a task. 1. A release in the last 365 days Fact: Newest release v0.0.6 on 2022-06-29, 1597 days ago. 0 releases in the last 365 days. Rule: The newest published GitHub release (a pre-release counts; a draft does not) is 365 days old or less. A repository that publishes only tags, or only to a package registry, has no GitHub release. The release refresh reads the 10 newest releases after each push to the repository, and at least each 30 days. The index refresh reads the date of the last push each day. Task: Prepare a release, but do not publish it. Find the changes since the newest release, propose the next semantic version and the release notes, and ask me to publish the GitHub release. If nothing changed since the newest release, skip this item. If the project publishes only to a package registry, add a CI step that also makes a GitHub release for each version tag. Rules for this work: - Each file must be true for this project. Do not copy text that does not apply to it. - Do not choose a licence, a contact, or a release version for me. Ask me. - Do not publish a release, change a repository setting, or push to the default branch. Make the changes on a new branch. - Keep each change small, and run the checks of this repository before you finish. - At the end, list each item as DONE, SKIPPED (with the reason), or NEEDS A DECISION (with the question). AwesomeRepos reads these facts again in its next scan. The definitions of the checks: https://awesomerepos.com/health-facts
Maintenance
1 of 4 checks (2 without data)-
Yes: Not archived
GitHub does not mark the repository as archived. Source
-
No: A push in the last 90 days
Last push on 2025-12-04, 343 days ago. Source
-
No data: Commits in the last 13 weeks
No data: AwesomeRepos has not read the weekly commits.
-
No data: Commits in 26 or more of the last 52 weeks
No data: AwesomeRepos has not read the weekly commits.
Releases
1 of 3 checks (1 without data)-
No: A release in the last 365 days
Newest release v0.0.6 on 2022-06-29, 1597 days ago. 0 releases in the last 365 days. Source
-
Yes: The newest release tag is a semantic version
The newest release tag is v0.0.6. Source
-
No data: A changelog file at the root
No data: AwesomeRepos has not scanned this repository.
Security practice
0 of 1 check (1 without data)-
No data: A security policy
No data: AwesomeRepos has not scanned this repository.
AwesomeRepos has not asked OpenSSF Scorecard about this repository.
Community files
1 of 3 checks (2 without data)-
Yes: A licence
GitHub finds the licence MIT. Source
-
No data: A contributing guide
No data: AwesomeRepos has not scanned this repository.
-
No data: A code of conduct
No data: AwesomeRepos has not scanned this repository.
Dependencies in the index
This section shows the packages that connect this repository to other repositories in the index.
The GitHub dependency graph of this repository names 59 direct packages (scanned on Nov 12, 2026). Packages from 7 other repositories in the index are among them.
No scanned repository names a package from this repository.
Uses (in the index) · 7
-
Maven: org.springframework:spring-aop, org.springframework:spring-beans, org.springframework:spring-core
- mockito/mockito 15K
Maven: org.mockito:mockito-core
-
GitHub Actions: actions/checkout
- NanoHttpd/nanohttpd 7.2K
Maven: org.nanohttpd:nanohttpd
-
Maven: org.hibernate:hibernate-core
- apache/groovy 5.5K
Maven: org.codehaus.groovy:groovy
- ronmamo/reflections 4.8K
Maven: org.reflections:reflections
Used by (in the index) · 0
None.
Sources: the GitHub dependency graph of each repository, and deps.dev for the source repository of each package (checked on Nov 3, 2026). A dependency graph also names development packages. deps.dev takes most source repositories from package metadata. How the dependency graph is made
Observations
Latest Observation, Nov 12, 2026: 9,100 stars, 1,850 forks, last push Dec 4, 2025, not archived. One of 2 Observations since Nov 11, 2026.