Modern apps ship dozens of analytics, advertising, and utility SDKs that run with the app's full permissions. A compromised SDK update, a typosquatted package, or a tampered CI runner can insert spyware or backdoors that pass store review. Because the code is signed with the developer's key, users and platforms trust it.
Inventory every SDK and library with an SBOM, pin and verify dependency versions, review SDK data collection and permissions, harden and sign the build pipeline, and monitor dependencies for new vulnerabilities and ownership changes.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2024Latest
#02mobile02-2024 Inadequate Supply Chain Security
