Read with very high levels of suspicion: there's a huge number of errors in this article.
The issues discussed seem surface-level troublesome to me. But they're extremely weasel-words and/or exaggerated. I don't think these guys have found a smoking gun, there's a lot of problems with this code but...
-
The permission list doesn't seem to match reality. The argument seems to be "TEMU code references these permissions, so they must try to get the permissions somehow". These red-flag permissions aren't on the Google Play store manifest however.
-
Very basic errors involving MAC Addresses and other fundamental computer concepts.
Etc. etc. The core problems here might be true, but I'll need a more legitimate tech-site to go over the data and actually tell me what the problem is, because a lot of this "article" is just hyperbolic fluff.
Hacker News has been talking about it (a venture capitalist forum, not really about "Hackers" per se). https://news.ycombinator.com/item?id=37427008 . Good discussion so far.
This is obviously a "Bear" company blogpost that short-sells a stock and then publishes negative data on that company. So remember, if the stock price falls, this blog makes money. That's their goal. I'm not saying that they're wrong, or that the stock price shouldn't fall, just remember that this is where the profits are for this "grizzly" company.
That's why I'd personally like an Android developer / security specialist go over the claims and tell me if there's actually a red-flag here or not.