This code is vulnerable if a carriage return is present after the <name> tag before <package> tag. AFAIK this happens because of the behaviour of Axiom. Axiom creates an OMText node for the carriage return. So when getNextOMSibling() is called instead of <package> element OMText is selected. But since the OMText cannot be cast to OMElement a ClassCastException occurs. This can be avoided by obtaining zipart OMElement with a call to getChild() or any related method which returns an OMElement reference. I can provide a patch for this if necessary.