From : https://github.com/appsecco/VyAPI

VyAPI is a vulnerable hybrid Android app that’s vulnerable by design. We call it VyAPI, because it’s flaws are pervasive and it communicates not just via IPC calls but API calls, too.