oauth2-resource-server

The fragment is ordinary Spring Security configuration and does not show malware or intentional supply-chain sabotage. It has security and correctness issues: an insecure HTTP JWKS endpoint, probable authority-prefix mismatch, non-explicit stateless session handling, deprecated APIs, and an unnecessary UserDetailsService. The JWKS URL should use HTTPS and trusted issuer-based configuration, and JWT authorities and session policy should be explicitly configured.