This project uses CFR to decompile, issues with the decompiled code should be reported for:

Compiled jar lacks some information present in the source code, most importantly many generic types, some local variable names, comments, etc., therefore perfect reproduction of the source code is not always possible and sometimes you will see compilation failure which you have to correct manually.

Continue the deveopment of a project you no longer have source for.

Via this plugin the actual decompiled source can be pulled into Eclipse, where you can manually study it (or even build it).

Even with valid artifacts tricking caches, MITM and compramising artifactories is possible.

Even if the library owner has no malicious intent, build servers can be compromised to include additional code into an otherwise legitimate library.Source attachment of a Maven artifact also cannot be trusted, since it is only uploaded to Maven, it can contain anything the author wants, if your IDE shows the source attachment instead of the decompiled source, you IDE can potentially help to hide the malicious code.Even if the library is open source, compiled version could potentially contain code not present in the source repository, Interesting case study is the original Eclipse decompiler plugin.Most of them are not really validated, any of them can potentially contain malicious content. Think for example jar files downloaded from Maven central.Validate/audit the content of a jar/war file for potential malicious content.New project will be created from the jar.File->Import->Other->Jar without source.

war as a project into you Eclipse IDE, even if you don't have the source by decompiling the jar

Eclipse how to install jar plugin