Supply Chain (OWASP Mobile M2)

A maliciously-behaving bundled SDK, a typosquatted-package scenario, and a build artifact with no signing/integrity verification.

8 vulnerabilities. OWASP Mobile: M2

Vulnerability	ID	Platform	Difficulty	OWASP	MASVS	MASWE	MASTG (v2)	CWE
Missing / Stale SBOM (No Component Inventory)	`sbom_missing_or_stale`	AndroidiOS	EASY	M2	MASVS-CODE-3 MASVS-CODE-1	MASWE-0044	MASTG-TEST-0274 MASTG-TEST-0275	CWE-1104 CWE-1035
Typosquatted Dependency	`typosquatted_dependency`	AndroidiOS	EASY	M2	MASVS-CODE-3	MASWE-0048	MASTG-TEST-0272 MASTG-TEST-0273	CWE-829 CWE-427
Insecure Firebase / Cloud Backend Config	`insecure_firebase_cloud_config`	AndroidiOS	MEDIUM	M8	MASVS-STORAGE-2 MASVS-NETWORK-1 MASVS-CODE-2	MASWE-0002	MASTG-TEST-0212 MASTG-TEST-0214	CWE-1188 CWE-668 CWE-798
Malicious Third-Party SDK	`malicious_third_party_sdk`	AndroidiOS	MEDIUM	M2	MASVS-CODE-3 MASVS-PRIVACY-1	MASWE-0048	MASTG-TEST-0318 MASTG-TEST-0319	CWE-506 CWE-829
Unsigned / Unverified Build Artifact	`unsigned_unverified_build_artifact`	AndroidiOS	MEDIUM	M2	MASVS-RESILIENCE-3 MASVS-CODE-1	MASWE-0057	-	CWE-347 CWE-494
Dependency Confusion / Substitution	`dependency_confusion`	AndroidiOS	HARD	M2	MASVS-CODE-3 MASVS-CODE-1	MASWE-0048	-	CWE-427 CWE-1357 CWE-494
Bundled SDK Ships a Vulnerable Exported Component	`sdk_exported_component_redirection`	AndroidiOS	HARD	M2	MASVS-CODE-3 MASVS-PLATFORM-1	MASWE-0032	MASTG-TEST-0364 MASTG-TEST-0372	CWE-926 CWE-749 CWE-829
Silent SDK Auto-Update (Post-Deploy Behavior Change)	`silent_sdk_auto_update`	AndroidiOS	HARD	M2	MASVS-CODE-3 MASVS-CODE-4	MASWE-0043	-	CWE-494 CWE-829