...
The class object being synchronized must not be accessible to hostile code. If the class is package-private, then external packages may not access the Class object, ensuring its trustworthiness as an intrinsic lock object. For more information, see CON04-J. Use the Synchronize using an internal private lock object idiom instead of the object's intrinsic lock.
Compliant Solution (Class.forName())
...