'Almost every Apple device' vulnerable to CocoaPods supply chain attack

Security researchers discovered multiple severe vulnerabilities in CocoaPods that allowed attackers to claim unowned packages, remotely execute code on the Trunk server, and perform zero-click account/session takeovers via email-scanning behavior; thousands of pods were orphaned and used by many popular apps, creating a material supply-chain risk. CocoaPods maintainers have applied patches and rotated session keys, and researchers reported no confirmed in-the-wild exploitation, but the potential scale and severity made the issue critical to address.