A backdoor in Nekogram was found that steals phone numbers, hidden in Extra .java. The code sends data through an inline query to @nekonotificationbot with minimal trace. If multiple accounts are connected, the developer can link them to the same person.

⚠️ Unfortunately, the Google Play Store version is also affected!!!

It’s unclear whether similar issues exist in forks like AyuGram and ExteraGram. These projects don’t provide up-to-date source code (some haven’t been updated in years), making it impossible to verify their latest releases.
This raises a key question: Are a few extra features worth risking your privacy when developers hide their Shady code for years? 📦

@raiyanmodscave