A critical integrity verification flaw in Melange and Apko could allow remote attackers to inject malicious code into software packages via supply chain manipulation.

The software fails to perform integrity checks on the data sections of APK packages, only validating the control section against the signed APKINDEX. An unauthenticated attacker capable of performing a man-in-the-middle attack or cache poisoning can substitute package contents without triggering a security alert.

The ability to inject arbitrary files into packages creates a severe risk of supply chain compromise. If exploited, an attacker could distribute backdoored binaries to downstream users, leading to unauthorized access, data theft, or total system compromise. With a CVSS score of 8.3, this vulnerability represents a high-risk vector for malicious code delivery that could bypass standard security controls.

Immediate Action: Update Melange to version 0.50.4 or later, and update Apko to version 1.2.9 or later, to ensure data section integrity is properly enforced.

Proactive Monitoring: Review build pipelines and package repository traffic for signs of unauthorized access or unexpected modifications to package metadata and binary caches.

Compensating Controls: Implement strict transport layer security (TLS) for package fetching and use internal, trusted mirrors to minimize the risk of man-in-the-middle attacks or cache poisoning.

Public Exploit Available: No

Given the potential for supply chain poisoning, organizations utilizing Melange or Apko must prioritize the identified updates. Failure to patch these tools leaves the build process vulnerable to silent code injection, which is difficult to detect once the malicious package is signed and deployed. Apply the recommended versions immediately to restore package integrity verification.