PoisonStack

A three-vector Android supply-chain attack PoC — malicious Gradle plugin, malicious KMP library, malicious IDE plugin. Research only.

PoisonStack ships three deliberately malicious components, one per layer of the Android developer's "trust stack". None uses a novel technique. Each uses documented APIs in the way the documentation said not to.

Layer	Component	Disguise
Build system	speedbuild-plugin/	A Gradle plugin that promises 50% faster builds
Dependency	kryptokit/	A KMP library that promises modern cryptography
IDE	androidlens-plugin/	An IntelliJ plugin that promises "AI insights"

A demo Android app that consumes the first two lives in victim-app/.

Where the content is

• docs/ — reference material: one page per vector, plus combined attack, detection, defense, references, and run instructions.
• articles/ — a four-part essay series derived from the docs, in English and Portuguese, intended for Medium / LinkedIn.

If you read one thing, read docs/01-overview.md.

Running the demo

cd speedbuild-plugin && ./gradlew publishToLocalMaven && cd -
cd kryptokit         && ./gradlew publishToLocalMaven && cd -
cd victim-app        && ./gradlew tasks

Full instructions, including the IDE plugin install, are in docs/09-running-the-demo.md.

Run this in a throwaway directory. The attacks are simulated — output goes to local log files inside each module's build/ — but a misconfigured local.properties is not something to discover after the fact.

Repository layout

PoisonStack/
├── README.md
├── docs/                   reference documentation
├── articles/               EN + PT-BR series, four parts
├── speedbuild-plugin/      Gradle plugin (vector 1)
├── kryptokit/              KMP library  (vector 2)
├── androidlens-plugin/     IDE plugin   (vector 3)
└── victim-app/             demo Android app consuming the first two

Toolchain

Recent stable versions (May 2026):

• Kotlin 2.3.20
• Android Gradle Plugin 9.1.1
• Gradle 9.0+, JDK 17+
• IntelliJ Platform plugin id org.jetbrains.intellij 1.17.4 (legacy)
• compileSdk/targetSdk 36, minSdk 24

Safety

Every malicious behaviour in this repository is simulated. Data is written to local log files; nothing is sent over the network. The components are unsigned, unpublished, and named so obviously they could not be confused for anything real.

None of that makes them safe to ship. Do not:

• publish any module to Maven Central, Gradle Plugin Portal, or the JetBrains Marketplace
• install the IDE plugin on a workstation that holds real credentials
• run the demo against a project whose local.properties contains real secrets

License

MIT, for the same reason most research code is MIT: removing friction is the only way the research gets read. You assume all liability for use.