I'm guessing it's an issue similar to what Geyser was having:

GeyserMC/Geyser#3662

Unfortunately there's not much I can do about it other than submit review requests to each of those 9 vendors, which is probably not something I'm going to make time to do.

While any Java project using Maven has some possibility of pulling in something malicious, I'm fairly confident that's not the case here. So I guess you can risk it or pass 🤷