Charging Ports: USB-C, USB PD, Qi2, the EU Rule and Juice Jacking

Charging moved from barrel jacks to Micro-USB (2007), Lightning (2012) and USB-C (2014), with USB Power Delivery now negotiating up to 240 W. EU law has required USB-C and USB PD on phones since 28 December 2024 and on laptops since 28 April 2026. Juice jacking works in research, but the FCC knew of no confirmed cases; use your own charger.

Underneath sits one fact: the USB-C port that negotiates 100 W also carries data. Phones answered with consent prompts and locked-port protections, and in 2025 researchers showed a charger could approve some of those prompts by itself. This post builds on our shorter look at what is documented about juice jacking and on the data side of the story in USB 1.0 to USB4 v2 and Thunderbolt.

Key takeaways

• Connectors: proprietary bricks, then Micro-USB (January 2007), Lightning (September 2012), USB-C (August 2014) and USB-C on iPhone (September 2023).
• USB PD is the power protocol spoken over USB-C: 100 W until PD 3.1 (26 May 2021) added 28, 36 and 48 V for 140, 180 and 240 W.
• PPS (PD 3.0) lets a phone request fine voltage steps for cooler fast charging. EPR is the 140 to 240 W range from PD 3.1.
• EU Directive 2022/2380 requires a USB-C port and, above 15 W, USB PD, on twelve device types from 28 December 2024 and laptops from 28 April 2026, and lets you buy the device without a charger.
• Qi2 adds a magnetic alignment profile. The WPC says it launched in November 2023 at 15 W; Qi2 25W followed in July 2025.
• The FCC said it knew of no confirmed instances of juice jacking. The FBI's Denver office said its 2023 warning had no specific case behind it.
• ChoiceJacking (USENIX Security 2025) showed a malicious charger could approve its own data connection on phones from all 8 vendors tested.
• Best defence: your own USB PD charger in a wall outlet, or a power bank.

A dated timeline of charging connectors, standards and rules

Dates marked with an asterisk come from Wikipedia's summaries of the original specifications, because the USB-IF and the Wireless Power Consortium (WPC) do not publish historic release dates on the pages we could reach. Unmarked dates come from the USB-IF, the WPC, EU texts, Apple, the FCC, CNBC or the researchers.

How did phone and laptop charging connectors evolve?

Barrel jacks and proprietary pins

For most of the 1990s and 2000s the charger was part of the product. Laptops used round barrel jacks in many sizes, voltages and polarities, and phones used pin connectors that changed between models. A barrel jack has no data lines and no negotiation, which had a quiet security benefit: the charger cannot talk to your device. The cost was waste and a drawer of incompatible bricks. The European Commission says it first tried a voluntary approach with industry, which "did not meet consumer, European Parliament or Commission expectations", before turning to law.

Micro-USB

The USB-IF announced Micro-USB on 4 January 2007 as a thinner successor to Mini-USB, rated for at least 10,000 insertions.* It became the default Android charging port for most of the next decade. Power was modest: USB 2.0 ports supplied 2.5 W and the Battery Charging 1.2 specification up to 7.5 W.* Makers who wanted more built their own fast charging signalling, and some older chargers signalled their current with voltages on the data lines.* Charging and data shared wires from the start.

Lightning

Apple announced iPhone 5 on 12 September 2012 with Lightning, which its release called "smaller, smarter and more durable" than the 30-pin connector, all digital and reversible. It was proprietary and licensed, and it was the iPhone's only wired port for eleven years.

USB-C

The USB Type-C specification 1.0 was finalised in August 2014.* The USB-IF lists its goals: a connector slim enough for phones yet sturdy enough for laptops, "reversible plug orientation and cable direction", and scalable power and performance. It replaced Micro-USB on Android phones, barrel jacks on many laptops once PD reached 60 to 100 W, and Mini DisplayPort for Thunderbolt.

A USB-C plug has a configuration channel (CC) alongside the data and power wires. The two ends use it to agree orientation, power direction, available current and alternate modes, and USB PD messages travel on it.* So power negotiation does not need the USB data lines, which matters for data blockers later.

Why did iPhone move from Lightning to USB-C?

Apple unveiled iPhone 15 Pro on 12 September 2023 with a USB-C connector running at USB 3 speeds, calling USB-C "a universally accepted standard for charging and transferring data" that lets one cable charge iPhone, Mac, iPad and AirPods Pro. The release does not mention regulation.

The timing still lines up with EU law. Directive 2022/2380, signed in November 2022, required a USB-C receptacle on phones sold in the EU from 28 December 2024, and a phone launched in September 2023 would still be on sale after that. The fair reading is both reasons: a hard EU deadline, and a faster port Apple's iPads and Macs already used. We found no primary Apple statement tying the change to the directive, so we do not claim one.

What do USB PD, PPS and EPR mean?

USB Power Delivery

The USB-IF describes USB as having evolved "from a data interface capable of supplying limited power to a primary provider of power with a data interface." USB PD is how. A PD charger advertises its power offers, the device picks one, the charger confirms, and only then does the voltage rise above 5 V. The USB-IF lists what PD adds beyond wattage:

• Power can flow either way. A monitor can charge a laptop while acting as its display.
• Devices take only what they need and can ask for more.
• Hubs and PCs can manage power across several peripherals.
• PD coexists with older Battery Charging implementations.

Up to PD 3.0 the ceiling was 100 W, from 20 V at 5 A. Currents above 3 A need an electronically marked cable rated for 5 A.* These modes are now called the Standard Power Range (SPR).*

PPS: Programmable Power Supply

PD 3.0 added an optional Programmable Power Supply mode. Rather than picking a fixed 5, 9, 15 or 20 V, the phone asks for a voltage between 3.3 and 21 V in 20 mV steps and current in 50 mA steps.* The charger's converter does the fine control, which moves heat out of the phone. Many phones need PPS for their fastest mode, so a PD charger without it may charge them more slowly than its wattage suggests.

EPR: Extended Power Range, up to 240 W

The USB Promoter Group announced PD 3.1 on 26 May 2021, "a major update to enable delivering up to 240W of power over the USB Type-C cable and connector." The USB-IF lists new fixed voltages of 28, 36 and 48 V for 140, 180 and 240 W, with USB Type-C Release 2.1 defining the cables. The announcement says the new architecture tightens power negotiation so the higher power is used safely, and that safety rules for 100 to 240 W products are stricter too.

PD 3.1 also added an Adjustable Voltage Supply (AVS) mode, which the USB-IF says lets a device request any voltage from 15 V up to the charger's highest fixed voltage. PD 3.2 in October 2023 brought AVS into the standard range down to 9 V.* AVS and PPS are separate, so a charger may support one and not the other.*

Spec comparison table

What does the EU common charger directive require, and from when?

Directive (EU) 2022/2380 amends the Radio Equipment Directive 2014/53/EU and was signed on 23 November 2022. The Commission pairs it with Delegated Regulation (EU) 2023/1717, which updates the technical references for wired charging.

Which devices, and from which date

Annex Ia lists thirteen categories. Twelve have been covered since 28 December 2024: handheld mobile phones, tablets, digital cameras, headphones, headsets, handheld videogame consoles, portable speakers, e-readers, keyboards, mice, portable navigation systems and earbuds. Laptops have been covered since 28 April 2026, defined broadly as portable computers, including notebooks, convertibles and netbooks. Member states had until 28 December 2023 to adopt national laws.

What the rule requires

For in-scope devices that charge by cable:

1. A USB Type-C receptacle, per EN IEC 62680-1-3.
2. USB PD above 5 V, 3 A or 15 W, per EN IEC 62680-1-2. Extra proprietary protocols are allowed, but must leave "the full functionality" of USB PD intact, whatever charger is used.
3. Unbundling. The device must be sold without a charger as an option. The Commission estimates this cuts e-waste by 980 tonnes a year.
4. Labelling. A pictogram shows whether a charger is included, and a label gives the power range and, for fast charging, the text "USB PD fast charging".

The Commission estimates consumers save at least 250 million euros a year on unneeded chargers.

What comes next

The Commission's page lists three follow-ups. Its first review report, on 30 June 2026, named seven product groups that could be added: smartwatches, fitness trackers, smart glasses, wristbands, AR and VR headsets, personal drones and video game controllers. By 28 December 2026 it will report on unbundling cables. And Regulation (EU) 2025/2052, applying from 14 December 2028, requires chargers for radio equipment to be common chargers with at least one USB Type-C port.

What about wireless?

The directive mandates no wireless standard. The Commission says wireless charging is still maturing, with little fragmentation, so rules would be premature. On 26 February 2025 it adopted standardisation request M/607 asking European standards bodies to prepare a harmonised standard.

What are Qi and Qi2, and what does the magnetic profile add?

Qi is the WPC's inductive charging standard, first released in 2010.* A pad drives a magnetic field through a coil and the phone's coil turns it back into current. Early Qi gave 5 W; Qi 1.2 in 2015 added a 15 W profile, and Qi 1.1 added foreign object detection so a pad stops heating a stray coin.* The WPC says over 13,000 products are Qi certified. Plain Qi's weakness was alignment: off centre meant slow and warm, and several phone makers added proprietary fast wireless modes.

Qi2 adds the Magnetic Power Profile (MPP), based on Apple's MagSafe.* A ring of magnets snaps phone and pad into alignment, and only MPP devices may use the "Qi2 in a circle" mark.* The WPC says Qi2 launched in November 2023 at 15 W and passed 1.5 billion certified devices within a year. On 23 July 2025 it launched Qi v2.2.1, branded Qi2 25W, with "nearly 70% more power than the original Qi2", and said major Android phones would join the ecosystem with it. Its release adds that earlier proprietary fast wireless protocols could be inconsistent across chargers.

Is wireless charging safer than a USB port?

For data, yes in practice. Qi pads and phones exchange power control messages, but Qi gives the pad no USB data session with your files. The remaining risks are product safety ones, such as uncertified pads with weak foreign object detection. The WPC's site links to a public database for checking certification.

What is juice jacking, and what do the FCC and FBI actually say?

Juice jacking is a malicious charging point, kiosk or cable that uses the USB data lines to read a phone's files or install software while it charges. The ChoiceJacking authors date the original attacks to roughly ten years before their paper, when USB connections were trusted by default.

The FCC

The FCC page "What is 'Juice Jacking' and Tips to Avoid It", last updated 27 April 2023, said juice jacking had been shown to work as a proof of concept, but that "the FCC is not aware of any confirmed instances of it occurring." Its tips: use AC outlets and pack your own chargers and cables, carry an external battery, consider a charging-only cable from a trusted supplier, and choose "charge only" if asked to share data or trust a computer.

An archived copy from November 2025 carries a banner saying the page is archived and no longer actively maintained. When we requested the live URL on 23 October 2026, fcc.gov said public access to it had been disabled. The advice did not change; the page stopped being maintained.

The FBI

On 6 April 2023 the FBI's Denver field office posted: "Avoid using free charging stations in airports, hotels or shopping centers," saying bad actors had found ways to use public USB ports to introduce malware and monitoring software. CNBC reported that the bulletin cited no recent instance of consumer harm and that the office said no specific case prompted it.

How worried should you be?

Both agencies give the same advice and neither cites a confirmed case. Our shorter juice jacking post covers the press debate. The summary for 2026: technically real, defended against by modern phones, those defences shown in 2025 to have gaps, and the cheapest fix free.

How do iOS and Android limit data over USB when locked or untrusted?

iPhone and iPad: "Trust This Computer"

Apple's support page explains the first gate. On first connection to a computer, the device asks whether to trust it, and trusting requires your passcode. Trusted computers "can sync with your device and access your device's photos, videos, contacts, and other content" until you change that or erase the device. Don't Trust blocks access and the alert returns next time. To forget every trusted computer, go to Settings, General, Transfer or Reset iPhone, Reset, Reset Location & Privacy.

iPhone and iPad: wired accessories when locked

Apple's page on allowing accessories covers the second gate. By default you must unlock the device before it talks to an accessory or computer. Locked, it will not talk to the accessory and might not charge from it, but it "will charge as usual when connected to a USB power adapter". Once unlocked, an accessory stays connected after relocking. The control is Settings, Privacy & Security, Wired Accessories:

Lightning models offer only the last two. Administrators can set this on supervised devices with Apple Configurator or device management.

Android: USB modes and Advanced Protection

Plug an Android phone into a computer and it shows a "Charging this device via USB" notification; Google's help says to tap it and pick File Transfer under "Use USB for" if you want the computer to see files.

Advanced Protection adds USB Protection. Google's help page says that while the screen is locked it blocks new USB data connections, charging still works, and fast charging "may not start until you unlock". Its stated limits: connections made while unlocked are not protected and persist after locking, data access takes a few seconds to cut off after unplugging, the port is unprotected until boot finishes, and results vary with the maker's USB implementation. It turns on with Device protection, which needs a screen lock. Google's own pages differ on coverage (Pixel 6 and later; all Pixels on Android 16 and later; select Android 17 devices), so check your phone.

All these gates assume only the person holding the phone can answer the prompt. That is what the next research tested.

What did the ChoiceJacking research show?

Florian Draschbacher, Lukas Maar, Mathias Oberhuber and Stefan Mangard of Graz University of Technology and A-SIT Austria presented "ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago" at USENIX Security in August 2025.

The finding

The juice jacking defences assume "an attacker cannot inject input events while establishing a data connection." The authors showed that fails. A USB port is either a host or a device at a given moment, but a charger can switch roles or use another channel, so it can trigger the consent prompt and then answer it as if it were a keyboard. In outline only:

• An Android accessory protocol accepted input messages outside the mode where it should, on every Android device tested.
• A timing flaw in Android input handling let queued keyboard input land after the prompt appeared, on 9 of 10 Android devices.
• A Bluetooth route let the charger pair as a Bluetooth input device and accept the prompt, on 10 of 11 devices across Android and iOS.

The paper reports access to "pictures, documents, app data" on all tested devices from eight vendors, including the top six by market share. Most cases needed the phone unlocked at some point while charging; on two vendors' phones it worked while locked. All testing was in a lab on research devices, and the paper reports no use in the wild.

What vendors did

The researchers reported between June and July 2024. Per the paper, all but one vendor acknowledged the findings; Samsung improved its USB mode selection; Google rated one locked-device flaw high severity and fixed it in the November 2024 Android Security Bulletin, with design fixes planned for later Android releases; and Apple added authentication prompts for USB connections in iOS 17.5, which the authors said had yet to reach iOS 18 when they wrote. Most of the remedy arrived as ordinary updates.

What it means for you

The authors note that modes which shut USB off while locked do not help once you unlock, which is when most of their techniques ran; that data blockers would stop it but few people carry them; and they propose consent prompts for every kind of USB access, keyboards included. For a traveller it is simpler: if you do not plug into a port you do not control, none of this applies.

Do data blockers and charge-only cables help?

Yes, with caveats. A data blocker passes power but leaves the USB data wires unconnected; a charge-only cable does the same internally. Nothing on the far end can open a USB data session, so neither a juice jacking host nor a ChoiceJacking style keyboard gets through. The FCC recommended buying a charging-only cable from a supplier you trust.

• They can slow charging. The ChoiceJacking authors note blockers interfere with power negotiation. Older fast charging signalled on the data lines; USB PD uses the CC wire, so whether a USB-C blocker keeps PD depends on its design.
• You cannot verify one by eye. Test it with your own laptop (step 4 below).
• You have to remember to carry it. A charger you always pack is easier.

Remove the unknown host where you can: your own charger in an outlet, or a power bank. Keep a blocker for the seat-back port or rental car.

Decision table: which control for which situation

What should a travel charging kit include?

1. A USB-C PD wall charger sized for your laptop, with PPS if your phone uses it.
2. Your own USB-C cable, rated for 5 A if you charge above 60 W.
3. A power bank you top up from your own charger, within airline battery rules.
4. A plug adapter, so the wall outlet is always an option.
5. A data blocker or charge-only cable, tested at home.
6. A Qi2 pad if your phone supports it.

Before leaving: update the phone, set Wired Accessories to Ask for New Accessories on a USB-C iPhone, and turn on Advanced Protection or Lockdown Mode if you are a likely target.

Step by step: check what your charger, cable and phone are doing

These commands only read state.

1. Phones

• iPhone: Settings, Privacy & Security, Wired Accessories: choose Ask for New Accessories or Always Ask. To forget trusted computers, use Reset Location & Privacy as above.
• Android: plug into your own laptop and confirm the "Charging this device via USB" notification stays on charging. Turn on Device protection under Advanced Protection where offered (the menu path varies by maker). Leave USB debugging off.

2. macOS: what the charger negotiated and what is attached

# "AC Charger Information" shows the charger's wattage
system_profiler SPPowerDataType

# USB devices on each bus (recent macOS; older versions use SPUSBDataType)
system_profiler SPUSBHostDataType

3. Linux: USB-C roles and Power Delivery offers

The kernel exposes USB-C ports through the typec class and PD capabilities through usb_power_delivery. Port names vary, so list first.

ls /sys/class/typec/

# Power and data roles, and how power was agreed (USB, 1.5A, 3.0A or usb_power_delivery)
cat /sys/class/typec/port0/power_role
cat /sys/class/typec/port0/data_role
cat /sys/class/typec/port0/power_operation_mode

# PD revision of the port and the attached charger or device
cat /sys/class/typec/port0/usb_power_delivery_revision
cat /sys/class/typec/port0-partner/usb_power_delivery_revision 2>/dev/null

# What the charger advertised, if your driver exposes it
find /sys/class/usb_power_delivery/ -maxdepth 3 -path '*source-capabilities*' 2>/dev/null

4. Test a charge-only cable or blocker

Use your own laptop and your own unlocked phone.

# Linux: watch USB events, then plug the phone in through the cable under test
udevadm monitor --udev --subsystem-match=usb

# Then list the USB tree; a phone listed here is talking USB data
lsusb -t

On macOS, compare system_profiler SPUSBHostDataType with and without the cable. If the phone appears as a USB device or asks whether to trust the computer, the cable carries data. A real charge-only path shows neither while the phone still charges.

5. Windows: record charger and USB driver state

# Battery and charging history report
powercfg /batteryreport /output "$env:USERPROFILE\battery-report.html"

# USB devices present now
Get-PnpDevice -PresentOnly -Class USB | Select-Object Status, FriendlyName, InstanceId

# USB controller drivers and versions, for your software inventory
Get-CimInstance Win32_PnPSignedDriver |
  Where-Object { $_.DeviceClass -eq 'USB' } |
  Select-Object DeviceName, DriverProviderName, DriverVersion, DriverDate

6. Keep the results

For a fleet, record the iPhone accessory policy from device management, Advanced Protection state where you can collect it, and USB-C controller and driver versions from laptops. The hardware and firmware supply chain inventory post covers how to structure that.

Where Safeguard fits, honestly

Very little of this is Safeguard's job. Safeguard does not manage phones, set USB accessory policy, test chargers, scan firmware or generate hardware bills of materials; those controls come from Apple, Google and your device management tooling. The one real link is that USB stacks and USB-C drivers are software components with versions, so if you collect them into a CycloneDX or SPDX file, safeguard scan --sbom <file> can match them against vulnerability databases and show which projects contain a given version.

Common mistakes

• Treating USB-C as a power rating. Without PD it gives 15 W at most; with PD, up to 240 W depending on charger, cable and device.
• Pairing a 100 W charger with a 3 A cable. Above 60 W you need a 5 A cable.
• Assuming PD means your phone's fastest mode. Some phones need PPS.
• Reading the EU rule as a ban on proprietary fast charging. Extra protocols are allowed if USB PD still works fully.
• Tapping Trust to dismiss a prompt. Trust is remembered; reset it if you did.
• Assuming a locked phone is sealed. It still charges, and Android's USB Protection does not cover connections made while unlocked.
• Relying on an untested blocker or a found or giveaway cable.
• Skipping updates while travelling. The ChoiceJacking fixes shipped as ordinary updates.

FAQ

Is juice jacking real?

It is technically possible and has been demonstrated, most recently in the 2025 ChoiceJacking research. The FCC said it knew of no confirmed instances, and the FBI's Denver office said its 2023 warning had no specific case behind it. Your own charger in a wall outlet removes nearly all of the risk.

When did the EU require USB-C on phones?

From 28 December 2024 for phones and eleven other device types sold in the EU, including tablets, cameras, earbuds and handheld consoles. Laptops followed on 28 April 2026.

Does the EU rule apply to laptops?

Yes, since 28 April 2026. Laptops that charge by cable need a USB-C receptacle and, above 15 W, USB PD support.

Why did Apple switch the iPhone to USB-C?

Apple cited a universal standard, one cable across its products and USB 3 speeds on the Pro models. EU law required USB-C on phones sold in the EU from 28 December 2024; Apple's announcement did not mention it.

What is the difference between USB PD and PPS?

USB PD is the protocol a charger and device use to agree voltage and current over USB-C. PPS is an optional PD 3.0 mode that lets the device request voltage in 20 mV steps, so charging runs cooler.

How many watts can USB-C deliver?

Up to 15 W without Power Delivery, 100 W with PD in the standard range, and 240 W with PD 3.1's Extended Power Range at 48 V and 5 A on an EPR-rated cable.

What is Qi2, and is it the same as MagSafe?

Qi2 is the WPC standard with the Magnetic Power Profile, which was based on MagSafe. It launched at 15 W in November 2023; Qi2 25W followed in July 2025.

Do USB data blockers work?

They cut the data wires, so a charging port cannot open a data session. They may slow fast charging, and you should test one with your own laptop before trusting it.

Fix it without waiting for upstream

Charging ports are a hardware and policy topic, but the code that drives them is software: USB stacks, USB-C port controller drivers and the device management agents that enforce accessory policy are built from open source components, and the scripts your team writes to collect driver inventory have dependencies too. The fit with what follows is indirect for phone and charger firmware, which only their vendors can fix, and direct for the software you build and ship.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The mobile app demo is a real Android session: you send work to a computer running the Safeguard CLI and approve each command on the phone with Allow once, Allow for turn or Deny. For anyone travelling, it shows a phone staying in control of what runs on the machine back home without being plugged into anything.

Click through it at your own pace, or open it full screen.

The local runner demo shows setting up Safeguard's runner on your own machine, approving it with a device code and scanning from the terminal. That is the flow for scanning the USB driver and agent inventory from step 6 on an IT workstation without sending it elsewhere.

Click through it at your own pace, or open it full screen.

The CLI demo is a real session: the Safeguard CLI reads a lodash finding and its advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval and pushes nothing. The same approve each step pattern applies when a vulnerable library turns up in an internal tool that collects device state across your fleet.

Click through it at your own pace, or open it full screen.

To try it on your own machines, download Safeguard and follow the CLI documentation.

Quick check

Sources

• USB-IF: USB Charger (USB Power Delivery)
• USB-IF: USB Type-C Cable and Connector Specification
• USB Promoter Group: USB Power Delivery Revision 3.1 announcement (26 May 2021)
• Directive (EU) 2022/2380 of 23 November 2022 (EUR-Lex)
• European Commission: One common charging solution for all
• Wireless Power Consortium: home page
• Wireless Power Consortium: Qi2 25W news release (23 July 2025)
• FCC: What is 'Juice Jacking' and Tips to Avoid It (archived copy; page updated 27 April 2023)
• CNBC: FBI says you shouldn't use public phone charging stations (10 April 2023)
• Apple Support: About the 'Trust This Computer' alert
• Apple Support: Allow USB and other accessories to connect to your iPhone or iPad
• Apple Newsroom: Apple Introduces iPhone 5 (12 September 2012)
• Apple Newsroom: Apple unveils iPhone 15 Pro and iPhone 15 Pro Max (12 September 2023)
• Google: Protect your Android device from USB threats with Advanced Protection Mode
• Google: Transfer files between your computer and Android device
• USENIX Security 2025: ChoiceJacking (Draschbacher, Maar, Oberhuber, Mangard)
• ChoiceJacking paper (PDF)
• Linux kernel: USB Type-C connector class
• Linux kernel: ABI testing files (typec and usb_power_delivery)
• Wikipedia: USB hardware
• Wikipedia: USB Power Delivery
• Wikipedia: Qi (standard)

Last reviewed: 23 October 2026.