OWASP Mobile Top 102024Rank #2Last reviewed 2026-07-27

M2:2024: Inadequate Supply Chain Security

Vulnerable or tampered third-party SDKs, libraries, and build tooling pulled into the mobile app, plus insecure build/release pipelines that let a compromised dependency reach production.

How it's found

Detected by inspecting the app's third-party SDKs and build pipeline for known-vulnerable or tampered components.

Standards mapping

CWE: CWE-1357 CWE-829 CWE-494
References: https://owasp.org/www-project-mobile-top-10/2023-risks/m2-inadequate-supply-chain-security.html

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

What is M2:2024 Inadequate Supply Chain Security?

Vulnerable or tampered third-party SDKs, libraries, and build tooling pulled into the mobile app, plus insecure build/release pipelines that let a compromised dependency reach production.

How do you find Inadequate Supply Chain Security?

Detected by inspecting the app's third-party SDKs and build pipeline for known-vulnerable or tampered components.

Which CWEs map to M2:2024?

M2:2024 maps to CWE-1357, CWE-829, CWE-494.

Does TurboPentest test for Inadequate Supply Chain Security?

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Related OWASP categories

Written and reviewed by

Michel Chamberland - Founder & CEO, IntegSec

CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security

Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.

Find these issues before an attacker does

TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.

Start a pentest

OWASP Mobile Top 102024Rank #2Last reviewed 2026-07-27

M2:2024: Inadequate Supply Chain Security

Vulnerable or tampered third-party SDKs, libraries, and build tooling pulled into the mobile app, plus insecure build/release pipelines that let a compromised dependency reach production.

How it's found

Detected by inspecting the app's third-party SDKs and build pipeline for known-vulnerable or tampered components.

Standards mapping

CWE: CWE-1357 CWE-829 CWE-494
References: https://owasp.org/www-project-mobile-top-10/2023-risks/m2-inadequate-supply-chain-security.html

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

What is M2:2024 Inadequate Supply Chain Security?

Vulnerable or tampered third-party SDKs, libraries, and build tooling pulled into the mobile app, plus insecure build/release pipelines that let a compromised dependency reach production.

How do you find Inadequate Supply Chain Security?

Detected by inspecting the app's third-party SDKs and build pipeline for known-vulnerable or tampered components.

Which CWEs map to M2:2024?

M2:2024 maps to CWE-1357, CWE-829, CWE-494.

Does TurboPentest test for Inadequate Supply Chain Security?

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Related OWASP categories

Written and reviewed by

Michel Chamberland - Founder & CEO, IntegSec

CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security

Find these issues before an attacker does

TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.

Start a pentest