vamp-mobile-audit
OWASP MASVS 2.0 static auditor for APK and IPA files.
VampSecure Labs Security Research Division — pure Python, zero external dependencies.
Features
- 15 MASVS 2.0 checks covering Android (MOBILE-001–009) and iOS (MOBILE-010–015)
- Zero external dependencies — uses only Python standard library (zipfile, struct, plistlib, re…)
- Pure-Python AXML parser for binary AndroidManifest.xml (no jadx/apktool required)
- DEX string extraction for secrets and weak-crypto pattern detection
- JSON + HTML reports suitable for automated pipelines and human review
- Exit codes compatible with CI/CD:
2= CRITICAL,1= HIGH/MEDIUM,0= clean
Checks
| ID | Title | Severity | Platform | MASVS |
|---|---|---|---|---|
| MOBILE-001 | APK debuggable habilitado | critical | android | MASVS-RESILIENCE-2 |
| MOBILE-002 | Backup sin cifrar permitido | high | android | MASVS-STORAGE-2 |
| MOBILE-003 | Tráfico HTTP en claro permitido | high | android | MASVS-NETWORK-1 |
| MOBILE-004 | Componente exportado sin permiso | high | android | MASVS-PLATFORM-1 |
| MOBILE-005 | Secretos hardcodeados en binario | critical | android | MASVS-STORAGE-1 |
| MOBILE-006 | Permisos peligrosos innecesarios | medium | android | MASVS-PLATFORM-2 |
| MOBILE-007 | Algoritmos criptográficos débiles | high | android | MASVS-CRYPTO-1 |
| MOBILE-008 | URLs HTTP en código fuente | medium | android | MASVS-NETWORK-1 |
| MOBILE-009 | Network Security Config ausente | medium | android | MASVS-NETWORK-2 |
| MOBILE-010 | ATS desactivado (NSAllowsArbitraryLoads) | critical | ios | MASVS-NETWORK-1 |
| MOBILE-011 | File sharing habilitado | medium | ios | MASVS-STORAGE-2 |
| MOBILE-012 | Secretos en Info.plist | critical | ios | MASVS-STORAGE-1 |
| MOBILE-013 | URL schemes personalizados expuestos | low | ios | MASVS-PLATFORM-1 |
| MOBILE-014 | Excepciones ATS por dominio | medium | ios | MASVS-NETWORK-1 |
| MOBILE-015 | Descripción de privacidad ausente | medium | ios | MASVS-PRIVACY-1 |
Installation
pip install vamp-mobile-audit
Or from source:
git clone https://github.com/Vampsecure-Labs/vamp-mobile-audit
cd vamp-mobile-audit
pip install -e .
Usage
# Audit an APK
vamp-mobile-audit app.apk
# Audit an IPA
vamp-mobile-audit app.ipa
# JSON report
vamp-mobile-audit app.apk --json report.json
# HTML report
vamp-mobile-audit app.apk --html report.html
# With case metadata
vamp-mobile-audit app.apk --case CASO-2026-001 --analyst "Equipo Red"
# Filter by severity
vamp-mobile-audit app.apk --severity critical high
# Quiet mode (exit code only)
vamp-mobile-audit app.apk --quiet
Exit codes
| Code | Meaning |
|---|---|
| 0 | No findings (clean) |
| 1 | HIGH or MEDIUM findings (no CRITICAL) |
| 2 | CRITICAL findings present |
License
AGPL-3.0-only — see LICENSE.
1 maintainer
Metadata
1 maintainer
Release files for vamp-mobile-audit 1.0.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| vamp_mobile_audit-1.0.0.tar.gz | 28.4 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| vamp_mobile_audit-1.0.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 53.9 kB
Release files / vamp_mobile_audit-1.0.0.tar.gz
| Download URL | vamp_mobile_audit-1.0.0.tar.gz |
|---|---|
| Size | 28.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
7a631bed26c7b65bbaf8572aaf161d25fb6e94fed9cd4376d37b6ee209675b8a
|
|
BLAKE2b-256 checksum How to use checksums |
ff8b42d2f2df804d320c91e6ff7895973e745dc71a38bdb8842bf5cc4641b3c3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.11.15
|
Release files / vamp_mobile_audit-1.0.0-py3-none-any.whl
| Download URL | vamp_mobile_audit-1.0.0-py3-none-any.whl |
|---|---|
| Size | 25.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
97b7947130ec9c9a5b55fa4c78e562d15f28ed087e29d6f59f0700847be722dd
|
|
BLAKE2b-256 checksum How to use checksums |
3f69babc6d4cf9a8e6aeb9a25d8f57106a53e9d98faa43bd44e2865a10af01f9
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.11.15
|
Security for vamp-mobile-audit 1.0.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
