Thankfully the fake Wisp publisher doesn't seem to have malicious intent, and was ...

Why Nostr? What is Njump? Join Nostr

npub1p2…c60yv

2026-04-01 13:29:26 UTC

Thankfully the fake Wisp publisher doesn't seem to have malicious intent, and was done moreso by accident than on purpose. However this does kick up a whole bunch of questions for Zapstore (npub10r8…t2p8):

- Shouldn't there be some kind of manual approval when app names collide with pre-existing ones?
- How can you let a different publisher publish an app with the same ID `com.wisp.app` as a pre-existing, trusted package from the original dev utxo the webmaster 🧑‍💻🍁 (npub1utx…50e8) ?
- There are literally zero flags/alerts/warnings on the interface when browsing this duplicate app.

Another example is Cake Wallet Cake Wallet (npub1lsr…m040), for the past few versions Google has flagged this as a malicious app (it wasn't the case before), so I have avoided upgrading, even though I originally installed the zapstore version. If it's not fixed soon I will have to uninstall then re-install via Play or another market (annoying as then a full re-sync is required).

To date I have enjoyed using zapstore, but I feel like this is a great lesson learned to tighten up some of the security measures so we maintain high trust in what is published there.

quoting
nevent1q…q3a7
Gm

At least the fake wisp on zapstore was from a friendly nostrich just playing with his bitcoins and Zapstore (nprofile…tdq0) is just bugged af

But still... don't download it
nevent1q…hju5

Author Public Key

npub1p26skxvgyn6wmxr0fayh7ctf7rvsxy3te2s5hjc3emxnhy39y27qtc60yv

Seen on

wss://nostr.superfriends.online

Show more details

Published at

2026-04-01 13:29:26 UTC

Kind type

1 Short Text Note

Event JSON

{ "id": "01ced31e8f1e9146746281d92998095c7b0cdd66ef7d59fe4755aa7226bde2d5", "pubkey": "0ab50b198824f4ed986f4f497f6169f0d903122bcaa14bcb11cecd3b922522bc", "created_at": 1775050166, "kind": 1, "tags": [ [ "q", "000020974826775438cb5fa1bb9195cd799292ffe24eb42b9672241659e54b3d", "wss://nostr.superfriends.online/", "e2ccf7cf20403f3f2a4a55b328f0de3be38558a7d5f33632fdaaefc726c1c8eb" ], [ "p", "78ce6faa72264387284e647ba6938995735ec8c7d5c5a65737e55130f026307d" ], [ "p", "e2ccf7cf20403f3f2a4a55b328f0de3be38558a7d5f33632fdaaefc726c1c8eb" ], [ "p", "fc07b38da6112fbe6cd4e093b057cbed108692705181673f32d5d40eadead4d9" ] ], "content": "Thankfully the fake Wisp publisher doesn't seem to have malicious intent, and was done moreso by accident than on purpose. However this does kick up a whole bunch of questions for nostr:npub10r8xl2njyepcw2zwv3a6dyufj4e4ajx86hz6v4ehu4gnpupxxp7stjt2p8: \n\n- Shouldn't there be some kind of manual approval when app names collide with pre-existing ones?\n- How can you let a different publisher publish an app with the same ID `com.wisp.app` as a pre-existing, trusted package from the original dev nostr:npub1utx00neqgqln72j22kej3ux7803c2k986henvvha4thuwfkper4s7r50e8 ?\n- There are literally zero flags/alerts/warnings on the interface when browsing this duplicate app.\n\nAnother example is Cake Wallet nostr:npub1lsrm8rdxzyhmumx5uzfmq47ta5ggdyns2xqkw0ej6h2qat026nvs7rm040, for the past few versions Google has flagged this as a malicious app (it wasn't the case before), so I have avoided upgrading, even though I originally installed the zapstore version. If it's not fixed soon I will have to uninstall then re-install via Play or another market (annoying as then a full re-sync is required).\n\nTo date I have enjoyed using zapstore, but I feel like this is a great lesson learned to tighten up some of the security measures so we maintain high trust in what is published there.\n\nnostr:nevent1qvzqqqqqqypzpckv7l8jqspl8u4y54dn9rcduwlrs4v2040nxce0m2h0cunvrj8tqys8wumn8ghj7mn0wd68ytnnw4cx2unxwf5k2mnywvhx7mnvd9hx2tcqyqqqqgyhfqn8w4pced06rwu3jhxhny5jll3yadptjeezg9jeu49n689q3a7", "sig": "6c12815bf47595277f971f3e6da111e4240e3efaaa59fe4113a4b3ccc881a26de4d9d1297499a498336980377af20ab19c73a75c0a1c1a5505e4e5e495534b8c" }