> 1) Dynamic compilation using runtime.exec()<p>"cmd package compile" doesn't compile source code at runtime. It forces ahead-of-time compilation of an application's existing bytecode, which is something which Android already does on an as-needed basis. I'm not sure why the Temu app would be running this command (performance, maybe?), but it isn't clearly dangerous either.<p><a href="https://source.android.com/docs/core/runtime/jit-compiler" rel="nofollow noreferrer">https://source.android.com/docs/core/runtime/jit-compiler</a><p>The rest of the analysis doesn't seem much better, e.g.<p>> 3) TEMU queries information related to files, and not just its own files, but wants information on all files on the user’s device by referencing “EXTERNAL_STORAGE”, superuser rights and log files.<p>The EXTERNAL_STORAGE permission is literally just external storage, like the name implies. It doesn't grant access to files in internal storage, like other applications' data or system logs.<p>> 5) “Root” access. TEMU checks if a device has “root” access.<p>Yes, this is fairly common. (And indeed, the table at the top of the report notes that most of the other shopping apps they analyzed did this.)<p>> 6) Encryption, decryption and shifting integer signals libraries are in prior versions of Pinduoduo and TEMU apps. The only purpose of this is obscuration of malicious intent.<p>I'm not even sure what they're trying to suggest by this. Are they actually assuming that any use of bit-shifting operators is malicious?<p>> 10) [...] The TEMU app even reads and stores the MAC address, which is a unique and global hardcoded network identifier of a device. This is a big No No in internet security. A Distributed Denial of Service (DDOS) attack and other unwanted security probes could conceivably be launched against a disclosed MAC address.<p>This is complete nonsense. MAC addresses don't work like that.<p>> 11) Looking over your shoulder while you use your smartphone. TEMU calls getWindow().getDecorView().getRootView(), to make screenshots<p>That only captures the appearance of the Temu application, not other applications on the system.