Security News > 2024 > July > Millions of Apple Applications Were Vulnerable to CocoaPods Supply Chain Attack
The security team says they found vulnerable CocoaPods pods in "The documentation or terms of service documents of applications provided by Meta, Apple, and Microsoft; as well as in TikTok, Snapchat, Amazon, LinkedIn, Netflix, Okta, Yahoo, Zynga, and many more."
E.V.A. reported the vulnerability to CocoaPods in October 2023, at which point it was patched.
"The CocoaPods team responded responsibly and swiftly to the vulnerabilities once disclosed," E.V.A. Information Security wrote.
Must-read Apple coverage Vulnerabilities originated in CocoaPods.
The CocoaPods vulnerabilities are a good reminder to developers and DevOps teams not to forget about dependency managers, which could be a potential weak link in supply chain security.
To handle the CocoaPods vulnerabilities, developers and DevOps teams should double check the open-source dependencies used in their application code.
News URL
https://www.techrepublic.com/article/apple-applications-cocoapods-supply-chain-attack/
Related news
- It's only a matter of time before LLMs jump start supply-chain attacks (source)
- PlushDaemon APT Targets South Korean VPN Provider in Supply Chain Attack (source)
- IPany VPN breached in supply-chain attack to push custom malware (source)
- Supply chain attack hits Chrome extensions, could expose millions (source)
- New Apple CPU side-channel attacks steal data from browsers (source)
- New SLAP & FLOP Attacks Expose Apple M-Series Chips to Speculative Execution Exploits (source)
- Abandoned AWS S3 buckets can be reused in supply-chain attacks that would make SolarWinds look 'insignificant' (source)
- Apple fixes zero-day exploited in 'extremely sophisticated' attacks (source)
- Apple warns 'extremely sophisticated attack' may be targeting iThings (source)
- Apple fixes zero-day flaw exploited in “extremely sophisticated” attack (CVE-2025-24200) (source)