Field Notes

source

Malware in F-Droid build of Nextcloud News App

StatusStableUpdatedStands on2 sourcesSupportsnotes

An F-Droid fdroiddata issue from August 2022 investigating why the F-Droid build of the Nextcloud News app contacted an interact.sh out-of-band interaction host that appeared in neither the developer’s GitHub APK nor the source tarball F-Droid claimed to have built. A saved copy is preserved here; the .raw.html companion is the provenance copy. The parallel investigation in the app’s own tracker is nextcloud/news-android#1109.

What happened

The injected code was not inserted by F-Droid and was not in the app’s source at all. A self-described security researcher had registered the nostra13.com domain, used JitPack’s custom-domain mechanism to publish a poisoned copy of the com.nostra13.universalimageloader dependency, and embedded a beacon — which its own source described as “an experiment I made on android vulnerability” — that phoned home the host app’s package name. The app’s build script listed JitPack as a repository and Gradle resolved the poisoned artifact in preference to the clean Maven Central one. The F-Droid build, which resolves dependencies fresh from remote repositories, picked it up; the developer’s GitHub APK, built against a warmed local dependency cache, did not.

JitPack removed the package within about a day of notification. F-Droid scanned its repository and found only that one APK affected, then shipped a clean rebuild.

What it is evidence for

This is the closest thing to a realized supply-chain incident in the main F-Droid repository, and its mechanics matter more than its drama. The attack surface was the dependency closure, not the app source, the signing key, or the build host. “Built from the published source” therefore does not bound what lands in the binary: a poisoned transitive dependency produces a binary that faithfully corresponds to the published source and is compromised anyway. That cuts in both directions for the argument in Android app distribution trust models: it vindicates the critics’ point that building from source is not a review of what ships, while showing that the property F-Droid actually guarantees — Source-to-binary correspondence — held exactly as advertised throughout the incident.

Limitations

The beacon was a researcher’s stunt rather than an exfiltration campaign, though the same channel could have carried one. A single incident bounds prevalence only in the weakest sense: F-Droid’s repository scan covered interact.sh specifically, not dependency poisoning generally.

Built on 2 sources (2 external).

Working out connections…