Official CocoaPods security update announcements

3 CocoaPods Vulnerabilities Expose 3 Million iOS and macOS Apps to Supply Chain Attacks

Jul 2, 2024, 03:45 PM

Millions of iOS and macOS applications were exposed to significant security risks due to three vulnerabilities in CocoaPods, a widely used open-source dependency manager. These flaws, present for about a decade, could have allowed attackers to execute supply chain attacks by injecting malicious code into 3 million apps. The vulnerabilities were caused by changes in how the package manager operates, which enabled anyone to claim ownership of orphaned packages and potentially execute remote code on the CocoaPods server. Security researchers have identified these critical flaws, and a patch was released last October to address the issues. Despite the patch, the long-term exposure has raised concerns about the security of Apple devices and the potential impact on millions of users.