Security News > 2024 > July > Millions of Apple Applications Were Vulnerable to CocoaPods Supply Chain Attack
The security team says they found vulnerable CocoaPods pods in "The documentation or terms of service documents of applications provided by Meta, Apple, and Microsoft; as well as in TikTok, Snapchat, Amazon, LinkedIn, Netflix, Okta, Yahoo, Zynga, and many more."
E.V.A. reported the vulnerability to CocoaPods in October 2023, at which point it was patched.
"The CocoaPods team responded responsibly and swiftly to the vulnerabilities once disclosed," E.V.A. Information Security wrote.
Must-read Apple coverage Vulnerabilities originated in CocoaPods.
The CocoaPods vulnerabilities are a good reminder to developers and DevOps teams not to forget about dependency managers, which could be a potential weak link in supply chain security.
To handle the CocoaPods vulnerabilities, developers and DevOps teams should double check the open-source dependencies used in their application code.
News URL
https://www.techrepublic.com/article/apple-applications-cocoapods-supply-chain-attack/
Related news
- Recent GitHub supply chain attack traced to leaked SpotBugs token (source)
- SpotBugs Access Token Theft Identified as Root Cause of GitHub Supply Chain Attack (source)
- That massive GitHub supply chain attack? It all started with a stolen SpotBugs token (source)
- Apple fixes two zero-days exploited in targeted iPhone attacks (source)
- Apple Patches Two Actively Exploited iOS Flaws Used in Sophisticated Targeted Attacks (source)
- Apple plugs zero-day holes used in targeted iPhone attacks (CVE-2025-31200, CVE-2025-31201) (source)
- Apple Patches Two Zero-Days Used in ‘Extremely Sophisticated’ Attacks (source)
- Ripple's xrpl.js npm Package Backdoored to Steal Private Keys in Major Supply Chain Attack (source)
- Ripple NPM supply chain attack hunts for private keys (source)
- Apple 'AirBorne' flaws can lead to zero-click AirPlay RCE attacks (source)