Why you should stop using Nekogram

[TunogLata]

BREAKING: Nekogram is secretly sending your phone numbers to the developer.
The backdoor is hidden in the Extra.java file, which differs from the template uploaded to the repository. The obfuscated code sends data as an inline request to @nekonotificationbot, leaving no trace.

More info: You do not have permission to view the full content of this post. Log in or register now.
(locked by Nekogram devs)
To validate this, a developer built a PoC — an LSPosed module that replaces the bot ID and username to theirs, redirecting all requests to it. This independently confirmed that phone numbers are being collected. Every. Login.

PoC available here:
You do not have permission to view the full content of this post. Log in or register now.

The developer's response when confronted:

Screenshots:

 

[xiaoyi]

Galit na galit haha

 

[Bon-chan]

fully archive all the conversations, commit logs, issue #336 from their official repo, fork/clone the entire repo itself, the release builds connected to the malicious commit, and try to reach out some social influencers that may help publicly expose these kind of stuff. Sa youtube dami mahilig mag expose ng ganyang open source projects na may malicious code

 

[Rectify]

What if si Turrit din ganito

 

[Hazama]

late na yata ako para magchange, yan gamit ko pa noon pa haha