SourMint: iOS remote code execution, Android findings, and community response

Snyk's research into the Mintegral advertising SDK found dangerous hidden functionality: an iOS backdoor (MTGInvocationBoxing/MTGRemoteCommandParser) enabling remote code execution via ads, pervasive HTTP request logging (potentially capturing sensitive headers), and Android mechanisms that track package installs and arbitrary downloads system-wide; these findings were disclosed to Apple and Google, prompted platform removals and SDK code changes, and highlight a supply-chain privacy/security risk for mobile apps.