Description

Detects when a Swift/CocoaPods project has dependencies declared in a Podfile but is missing the corresponding Podfile.lock file. Without a lock file, the exact versions of dependencies are not pinned, which can lead to supply chain attacks and inconsistent builds.

Detection Strategy

• Scan for presence of a Podfile that declares CocoaPods dependencies

• Check if a Podfile.lock exists in the same directory as the Podfile

• Report a vulnerability if dependencies are declared but no Podfile.lock is present