M2: Inadequate Supply Chain Security
Third-party dependencies and SDKs with known vulnerabilities, malicious packages, or outdated components pulled directly into the app.
Why It Matters
A mobile app typically ships with dozens of third-party SDKs — analytics, crash reporting, ad networks, payment libraries. Each one runs with the app's own permissions and data access, so a vulnerable or malicious dependency compromises the app without the app's own code being at fault.
Application to Application Security
Covers known-CVE dependency versions, unmaintained libraries with no active patch stream, and typosquatted or otherwise suspicious package names introduced accidentally by a dependency manager.
Relation to Software Development
Dependencies are added once and rarely revisited; a library that was safe at integration time can accumulate CVEs over years while the app continues shipping the same pinned version.
How Strata Surfaces This
Dependency extraction from build manifests (build.gradle, Podfile, Package.swift), CVE lookup against the OSV database, and version comparison against known-vulnerable ranges — run on every scan, not just at project setup.
Developer guidance
Track dependency CVEs continuously, not at release time only, and prefer libraries with an active maintenance history over ones that are merely feature-complete.
Management guidance
Supply chain risk compounds silently — a dependency review cadence (quarterly, at minimum) should be a standing engineering practice, not an incident-response reaction.