I have read [here](https://www.infoworld.com/article/3644492/how-to-detect-the-log4j-vulnerability-in-your-applications.html) that the log4j library can be "nested" within other files that are deployed with an application.

I can find files with 'log4j' in the filename but don't know how to find log4j in these "nested jars". Is there a utility I can use from the command line that can inspect the contents of nested jars?

update
------

I am going to try to use the '[syft](https://github.com/anchore/syft)' open-source tool on WSL2 Ubuntu linux running on my windows box. I expect the file scanning to be slower from WSL2 (across a pseudo-network boundary to the windows side of the filesystem) but it should still work. I will update here with results.