The Javadoc documentation for the Package class states: Package objects contain version information about the implementation and specification of a Java package. This versioning information is ...

Open-source software is everywhere now, but the Log4j flaw that affects Java enterprise applications ... scanning – that is, packages containing vulnerable Log4j code within the artefact itself.