161-java-profiling-detect

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.85). The profiling scripts call curl/wget at runtime to download async-profiler from GitHub (e.g. https://github.com/async-profiler/async-profiler/releases/download/v4.1/async-profiler-4.1-linux-x64.tar.gz), extract it, and then execute its binaries (asprof), so the fetched URL supplies required remote code that is executed.