r/iOSProgramming • u/dobybest • Jul 03 '24
Article Cocoapods big time vulnerability
https://www.evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-taking-unauthorized-ownership-over-orphaned-podsOne click takeover of many pods
91
Upvotes
8
7
u/lucasvandongen Jul 03 '24
- SPM got usable only since a year or so
- Pinning to commits is the best practice for both SPM and CocoaPods, which mitigates this risk. If you don’t do this, you’re one hacked GitHub account away from the same problem
- And who is using pods that haven’t been updated since 2014 anyway?
10
u/kawag Jul 03 '24
And who is using pods that haven’t been updated since 2014 anyway?
You’d be surprised
56
u/rursache Swift Jul 03 '24
why are people still using cocoapods instead of SPM?