Mailing the story:
Millions of Apple Applications Were Vulnerable to CocoaPods Supply Chain Attack
The vulnerabilities have since been patched, but had quietly persisted since the CocoaPods migration in 2014. Many macOS and iOS applications were open to a vulnerability in CocoaPods, an open-source dependency manager, E.V.A. Information Security revealed on July 1. The vulnerability has been patched since EVA first discovered it, and no attacks have occurred that are conclusively related to it.