It looks like the natpmp package uses jNAT-PMPlib library which is very old and seems abandoned.
But what it dangerous is that the package uses LGPLv3 License while the whole TomP2P uses Apache 2.
There is a newer https://github.com/offbynull/portmapper which also supports PCP (i.e. NATPMP 2) and even UPnP. It also uses Apache 2 License.
Could you please migrate to the newer library?
It looks like the natpmp package uses jNAT-PMPlib library which is very old and seems abandoned. But what it dangerous is that the package uses LGPLv3 License while the whole TomP2P uses Apache 2. There is a newer https://github.com/offbynull/portmapper which also supports PCP (i.e. NATPMP 2) and even UPnP. It also uses Apache 2 License. Could you please migrate to the newer library?