Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Open source now makes up 70% to 90% of many codebases, but the same dependency model expands mobile attack surface through compromised packages, transitive dependencies, and unpatched vulnerabilities, according to Guardsquare. Mobile app teams need MAST, SCA, SBOM discipline, and runtime protections because visibility without lifecycle control still leaves exploitable gaps.
NHIMG editorial — based on content published by Guardsquare: The Importance of MAST in the Age of Open Source Software
By the numbers:
- Packages cumulating over 2 billion weekly downloads and more than 190 mobile apps were affected in the September 2025 npm supply chain attack.
Questions worth separating out
Q: How should teams reduce supply chain risk in mobile apps with many open source dependencies?
A: Teams should combine SBOM-based inventory, SCA, SAST, and MAST so they can see what is in the app, what is known to be vulnerable, what is insecure in code, and what changes at runtime.
Q: Why do transitive dependencies create more mobile app risk than direct libraries alone?
A: Transitive dependencies hide risk several layers deep inside packages the team did not choose directly, which makes review and patching slower.
Q: What are the signs that mobile secrets management is failing in production apps?
A: Look for hardcoded API keys, tokens, or cloud credentials in source and bundled binaries, repeated dependency updates that leave old packages in place, and runtime calls to unexpected endpoints.
Practitioner guidance
- Build dependency inventories from SBOM data Track direct and transitive dependencies for every mobile release so security teams can see where risk enters the codebase and which packages remain unreviewed.
- Separate SCA, SAST, and MAST gates Use SCA to detect known vulnerable components, SAST to catch hardcoded secrets and weak patterns, and MAST to test runtime behaviour such as insecure storage or unexpected endpoints.
- Remove embedded secrets before release Search mobile code and bundled libraries for API keys, tokens, and cloud credentials, then replace them with short-lived, centrally governed credentials.
What's in the full article
Guardsquare's full article covers the operational detail this post intentionally leaves for the source:
- How AppSweep fits into CI/CD scanning for mobile release pipelines and periodic validation
- The step-by-step breakdown of MAST findings such as insecure storage, weak encryption, and TLS/SSL issues
- OWASP MASTG and MASWE references for third-party libraries and dependency vulnerabilities
- Regulatory and industry compliance context for mobile testing before release
👉 Read Guardsquare's analysis of MAST, open source dependencies, and mobile app risk →
Open source mobile apps: is MAST enough to reduce supply chain risk?
Explore further
02/09/2026 1:30 pm
Open source dependency sprawl now functions like non-human identity sprawl. When mobile apps inherit hundreds of direct and indirect libraries, each package can carry embedded secrets, external service access, or update trust that is never revalidated. That mirrors the NHI problem: control failure is rarely about one secret, but about the estate of dependencies around it. Practitioners should treat dependency inventories as governance objects, not just build artefacts.
A question worth separating out:
Q: How can security teams tell whether MAST is enough on its own?
A: MAST is not enough when the main risk comes from vulnerable packages, embedded secrets, or compromised dependencies that only show their effect after deployment. If teams cannot answer where components came from, when they were last patched, and how they are revoked, MAST is only one layer of control.
👉 Read our full editorial: MAST is essential for open source mobile app security
