Security News > 2024 > July > Millions of Apple Applications Were Vulnerable to CocoaPods Supply Chain Attack
The security team says they found vulnerable CocoaPods pods in "The documentation or terms of service documents of applications provided by Meta, Apple, and Microsoft; as well as in TikTok, Snapchat, Amazon, LinkedIn, Netflix, Okta, Yahoo, Zynga, and many more."
E.V.A. reported the vulnerability to CocoaPods in October 2023, at which point it was patched.
"The CocoaPods team responded responsibly and swiftly to the vulnerabilities once disclosed," E.V.A. Information Security wrote.
Must-read Apple coverage Vulnerabilities originated in CocoaPods.
The CocoaPods vulnerabilities are a good reminder to developers and DevOps teams not to forget about dependency managers, which could be a potential weak link in supply chain security.
To handle the CocoaPods vulnerabilities, developers and DevOps teams should double check the open-source dependencies used in their application code.
News URL
https://www.techrepublic.com/article/apple-applications-cocoapods-supply-chain-attack/
Related news
- OpenWrt orders router firmware updates after supply chain attack scare (source)
- Update your OpenWrt router! Security issue made supply chain attack possible (source)
- Ultralytics Supply-Chain Attack (source)
- 390,000 WordPress accounts stolen from hackers in supply chain attack (source)
- Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack (source)
- It's only a matter of time before LLMs jump start supply-chain attacks (source)
- PlushDaemon APT Targets South Korean VPN Provider in Supply Chain Attack (source)