Skip to content

New weaknesses regarding 3rd party libs #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

New weaknesses regarding 3rd party libs #11

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
5fb602f
App placeholders for 3rd party libs
Diolor Sep 24, 2025
047f464
Fix placeholder id
Diolor Sep 24, 2025
c5616dd
Merge branch 'main' into new-weaknesses-3rd-party-libs
cpholguera Nov 12, 2025
c697cd1
Update MASWE-xxxA.md
Diolor Nov 13, 2025
61b19af
Revise MASWE-xxxB for malicious library risks
Diolor Nov 13, 2025
3d936bf
Update weaknesses/MASVS-PRIVACY/MASWE-xxxB.md
Diolor Nov 14, 2025
c215816
Revise MASWE-xxxB to clarify risks of embedding malicious third-party…
Diolor Nov 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions weaknesses/MASVS-PRIVACY/MASWE-xxxB.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
---
title: Dependencies Known to be Malicious
id: MASWE-xxxB
alias: data-leak-malicious-libraries
platform: [android, ios]
profiles: [L1,L2]
mappings:
masvs-v2: [MASVS-CODE-3]
cwe: [829]
draft:
description: |
Embedding third-party libraries known to be malicious may be risky. Such libraries act as an insider threat from within the app's process and boundaries. To mitigate apply chain security best practices, such as Software composition analysis (SCA) (generate a Bill of Materials (BOM), which is then compared against a variety of databases) to ensure the integrity of embedded libraries.
status: placeholder

---