From Russia with doubt: Go library's Kremlin ties stoke fear
(2025/05/06)
- Reference: 1746552609
- News link: https://www.theregister.co.uk/2025/05/06/from_russia_with_doubt_go/
- Source link:
Easyjson, a software library for serializing data in Golang applications, is maintained by developers affiliated with Russia's VK Group.
And this, according to security biz Hunted Labs, presents a potential security risk for US government organizations and private sector firms. Hunted said it takes this position because VK Group is allegedly [1]controlled by [2]Russian state entities and its CEO, Vladimir Kiriyenko, is currently [3]subject to US sanctions .
No malicious code has been identified in [4]the easyjson library , which is used in popular open source projects like ArgoCD, Cilium, Cosign, Grafana, Helm, Istio, Kubernetes, Prometheus, and Sigstore, among others.
[5]
However, the possibility that the open source package could be subverted at the behest of the Russian state raises questions for how public and private sector organizations in the US should view associated applications in light of compliance obligations.
[6]
[7]
In a [8]report published on Monday, Hunted Labs outlines the alleged risk.
"Russia doesn't need to attack directly," the company claims in a [9]blog post . "By influencing state-sponsored hackers to embed a seemingly innocuous [open source software] project deep in the American tech stack, they can wait, watch, and pull strings when it counts. A well-placed backdoor or subtle bug could become the digital equivalent of a sleeper cell – with impact spanning from the Pentagon to your iPhone."
[10]
A year after the discovery of the [11]backdoored XZ compression library , such scenarios have become harder to dismiss as paranoia. The reality is that in both public and private sector organizations, there's some concern about hiring developers with known or concealed ties to countries deemed national adversaries, such as [12]China, Russia , and [13]North Korea .
Hayden Smith, co-founder and chief technology officer of Hunted Labs, told The Register that his company was reviewing the risks posed by various open source applications for a client and easyjson stood out because it was present in so many projects.
"This was actually something that the US government had wanted us to do for this client," Smith said. "So they asked for what's called a foreign ownership contribution and influence [assessment], or FOCI. They wanted to look at what's the foreign ownership and control of these different open source packages that are found within this client's application."
[14]
Easyjson, Hunted Labs researchers noticed, was run by software developers associated with VK Group, also known as Mail.ru, entities that have [15]a history of cooperation with Russia's Federal Security Bureau (FSB).
[16]IT pros are caught between an AI rock and an economic hard place
[17]Signal chat app clone used by Signalgate's Waltz was apparently an insecure mess
[18]Microsoft tries to knife passwords once and for all - at least for consumers
[19]Generative AI makes fraud fluent – from phishing lures to fake lovers
"To be completely clear, we're not saying that everyone based in Russia or everyone based in China is a bad guy," said Smith. "We're not out here to say that. What we're here to say, though, is if those individuals come from certain organizations that have previously been attached to any kind of suspicious activity against the United States, then we need to take a second look at that and really consider the source of where that software is ultimately coming from."
Smith said Hunted Labs found no evidence that any of easyjson's developers have ties to known malware or ransomware groups. Nor was any dubious or malicious code identified within the easyjson repo.
"During our analysis, what we did observe, though, was some pretty weak security posture just around the open source," said Smith. "If you look at [20]OpenSSF , they have all these different security checks that you can enable. And it's really best practice-type stuff, like, do you do branch protection? Do you do fuzzing? Do you do SAST [Static Application Security Testing]? Is the code peer-reviewed? And when you look at that, [easyjson] was particularly weak – it scored about a three point seven [out of 10], which is really, really low."
The issue for Smith is what level of trust is appropriate for organizations trying to demonstrate due diligence – a vexing question after a US government official inadvertently invited a journalist [21]to messaging app discussions of military planning . Pointing to the [22]xz library compromise , in which one or more individuals using a pseudonym backdoored a compression library over a prolonged period of time, Smith said trust is the most dangerous weapon for targeting the open source software supply chain.
"So we're really trying to push the defensive perimeter a little bit further upstream so we can evaluate that trust and provide some measure there from a risk perspective," he said.
Smith noted that while government agencies can't buy Huawei equipment because of sanctions, they can still download and install open source contributions from Huawei engineers. What then does it mean to have open source code coming from developers affiliated with sanctioned individuals or entities, he asked.
"We need to start thinking about who the people [are] who are actually upholding the open source pillars that we all rely on," he said
Hunted Labs, he said, anticipates applying similar scrutiny to open source projects overseen by developers in China.
And in China, Russia, and other nation-state adversaries, perhaps there's been a similar crisis of faith in open source code written by US-based maintainers. ®
Get our [23]Tech Resources
[1] https://www.theguardian.com/world/2013/apr/18/russian-internet-social-media-network
[2] https://dgap.org/en/research/publications/russia-purports-build-fully-controlled-state-run-it-ecosystem
[3] https://sanctionssearch.ofac.treas.gov/Details.aspx?id=34596
[4] https://github.com/mailru/easyjson
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aBqGfjzVZggAx8dtVS7NjAAAAMM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aBqGfjzVZggAx8dtVS7NjAAAAMM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aBqGfjzVZggAx8dtVS7NjAAAAMM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://huntedlabs.com/the-russian-open-source-project-that-we-cant-live-without/
[9] https://huntedlabs.com/the-russian-open-source-project-that-we-cant-live-without/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aBqGfjzVZggAx8dtVS7NjAAAAMM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2024/03/29/malicious_backdoor_xz/
[12] https://www.theregister.com/2019/11/04/gitlab_chinese_russian_support_staff_ban/
[13] https://www.theregister.com/2025/04/29/north_korea_worker_interview_questions/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aBqGfjzVZggAx8dtVS7NjAAAAMM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.wired.com/story/vk-russia-democracy/
[16] https://www.theregister.com/2025/05/05/between_the_ai_rock_and/
[17] https://www.theregister.com/2025/05/05/telemessage_investigating/
[18] https://www.theregister.com/2025/05/04/security_news_in_brief/
[19] https://www.theregister.com/2025/05/02/gen_ai_spam/
[20] https://openssf.org/
[21] https://www.theregister.com/2025/04/25/signalgate_lessons_learned_if_creating/
[22] https://www.theregister.com/2024/03/29/malicious_backdoor_xz/
[23] https://whitepapers.theregister.com/
And this, according to security biz Hunted Labs, presents a potential security risk for US government organizations and private sector firms. Hunted said it takes this position because VK Group is allegedly [1]controlled by [2]Russian state entities and its CEO, Vladimir Kiriyenko, is currently [3]subject to US sanctions .
No malicious code has been identified in [4]the easyjson library , which is used in popular open source projects like ArgoCD, Cilium, Cosign, Grafana, Helm, Istio, Kubernetes, Prometheus, and Sigstore, among others.
[5]
However, the possibility that the open source package could be subverted at the behest of the Russian state raises questions for how public and private sector organizations in the US should view associated applications in light of compliance obligations.
[6]
[7]
In a [8]report published on Monday, Hunted Labs outlines the alleged risk.
"Russia doesn't need to attack directly," the company claims in a [9]blog post . "By influencing state-sponsored hackers to embed a seemingly innocuous [open source software] project deep in the American tech stack, they can wait, watch, and pull strings when it counts. A well-placed backdoor or subtle bug could become the digital equivalent of a sleeper cell – with impact spanning from the Pentagon to your iPhone."
[10]
A year after the discovery of the [11]backdoored XZ compression library , such scenarios have become harder to dismiss as paranoia. The reality is that in both public and private sector organizations, there's some concern about hiring developers with known or concealed ties to countries deemed national adversaries, such as [12]China, Russia , and [13]North Korea .
Hayden Smith, co-founder and chief technology officer of Hunted Labs, told The Register that his company was reviewing the risks posed by various open source applications for a client and easyjson stood out because it was present in so many projects.
"This was actually something that the US government had wanted us to do for this client," Smith said. "So they asked for what's called a foreign ownership contribution and influence [assessment], or FOCI. They wanted to look at what's the foreign ownership and control of these different open source packages that are found within this client's application."
[14]
Easyjson, Hunted Labs researchers noticed, was run by software developers associated with VK Group, also known as Mail.ru, entities that have [15]a history of cooperation with Russia's Federal Security Bureau (FSB).
[16]IT pros are caught between an AI rock and an economic hard place
[17]Signal chat app clone used by Signalgate's Waltz was apparently an insecure mess
[18]Microsoft tries to knife passwords once and for all - at least for consumers
[19]Generative AI makes fraud fluent – from phishing lures to fake lovers
"To be completely clear, we're not saying that everyone based in Russia or everyone based in China is a bad guy," said Smith. "We're not out here to say that. What we're here to say, though, is if those individuals come from certain organizations that have previously been attached to any kind of suspicious activity against the United States, then we need to take a second look at that and really consider the source of where that software is ultimately coming from."
Smith said Hunted Labs found no evidence that any of easyjson's developers have ties to known malware or ransomware groups. Nor was any dubious or malicious code identified within the easyjson repo.
"During our analysis, what we did observe, though, was some pretty weak security posture just around the open source," said Smith. "If you look at [20]OpenSSF , they have all these different security checks that you can enable. And it's really best practice-type stuff, like, do you do branch protection? Do you do fuzzing? Do you do SAST [Static Application Security Testing]? Is the code peer-reviewed? And when you look at that, [easyjson] was particularly weak – it scored about a three point seven [out of 10], which is really, really low."
The issue for Smith is what level of trust is appropriate for organizations trying to demonstrate due diligence – a vexing question after a US government official inadvertently invited a journalist [21]to messaging app discussions of military planning . Pointing to the [22]xz library compromise , in which one or more individuals using a pseudonym backdoored a compression library over a prolonged period of time, Smith said trust is the most dangerous weapon for targeting the open source software supply chain.
"So we're really trying to push the defensive perimeter a little bit further upstream so we can evaluate that trust and provide some measure there from a risk perspective," he said.
Smith noted that while government agencies can't buy Huawei equipment because of sanctions, they can still download and install open source contributions from Huawei engineers. What then does it mean to have open source code coming from developers affiliated with sanctioned individuals or entities, he asked.
"We need to start thinking about who the people [are] who are actually upholding the open source pillars that we all rely on," he said
Hunted Labs, he said, anticipates applying similar scrutiny to open source projects overseen by developers in China.
And in China, Russia, and other nation-state adversaries, perhaps there's been a similar crisis of faith in open source code written by US-based maintainers. ®
Get our [23]Tech Resources
[1] https://www.theguardian.com/world/2013/apr/18/russian-internet-social-media-network
[2] https://dgap.org/en/research/publications/russia-purports-build-fully-controlled-state-run-it-ecosystem
[3] https://sanctionssearch.ofac.treas.gov/Details.aspx?id=34596
[4] https://github.com/mailru/easyjson
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aBqGfjzVZggAx8dtVS7NjAAAAMM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aBqGfjzVZggAx8dtVS7NjAAAAMM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aBqGfjzVZggAx8dtVS7NjAAAAMM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://huntedlabs.com/the-russian-open-source-project-that-we-cant-live-without/
[9] https://huntedlabs.com/the-russian-open-source-project-that-we-cant-live-without/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aBqGfjzVZggAx8dtVS7NjAAAAMM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2024/03/29/malicious_backdoor_xz/
[12] https://www.theregister.com/2019/11/04/gitlab_chinese_russian_support_staff_ban/
[13] https://www.theregister.com/2025/04/29/north_korea_worker_interview_questions/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aBqGfjzVZggAx8dtVS7NjAAAAMM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.wired.com/story/vk-russia-democracy/
[16] https://www.theregister.com/2025/05/05/between_the_ai_rock_and/
[17] https://www.theregister.com/2025/05/05/telemessage_investigating/
[18] https://www.theregister.com/2025/05/04/security_news_in_brief/
[19] https://www.theregister.com/2025/05/02/gen_ai_spam/
[20] https://openssf.org/
[21] https://www.theregister.com/2025/04/25/signalgate_lessons_learned_if_creating/
[22] https://www.theregister.com/2024/03/29/malicious_backdoor_xz/
[23] https://whitepapers.theregister.com/
On the one hand, then the other
Creslin
The bad,
You can't really ignore millions of pulls from mail.ru repo each day as direct or indirect dependencies in the context of supply chain risk evaluation.
mail.ru is not a "ban everything coded by russians" frothy mouthed spluttering.
mail.ru/vk was force bought by Gazprom(kremlim) and the kremlins deputy chief of staff's (since 2016) son given the role of CEO.
The son is explicitly named and subject to US and EU sanctions.
It is hard to rationalize whilst the code is safe today its beyond risk of being tainted at any time.
The good,
Golang versioning can't be side-stepped easily, if at all, - albeit a new version would undeniably quite quickly through automated builds and indirect dependencies be widely dispersed.
However it would be noticed and many eyes are watching the diff's. Perhaps even github would take action if a library change so widely used was reported as malicious
Maybe some CI tests to warn on version bump are worthy, if refactoring out indirect dependencies are not feasible
Seems so easy to hide the underlying provenance of the code
elDog
While a .RU TLD might raise some eyebrows, it is childishly simple to have 2 or more levels of indirection as owners/maintainers to the code base.
It seems obvious (to me) that anyone that delivers software or hardware from within the USSR would be highly suspect. Just like any news coming from that autocratic state. Easily co-opted.
Since the US is apparently a vassal state with Putin as its behind-the-curtain leader, I'd question a lot of American products also.
ChoHag
Maybe stop running random code you found online without reading it first?
Security? Yea, right
I have no idea if this library has any security issues or not. But if it does have links to some Russian gov gangster outfit then there is clearly scope for concern.
Given this, I despair that it seems to be so widely used and (apparently) nobody has noticed the issue up until now. It highlights the real dangers of just blindly (how else would you describe it?) including some stuff found on the internet into your product, and the backseat that security (of one’s product) takes. Even in today’s rancid tech climate
It’s sloppy and lazy - except for those product-makers that have actually done their due diligence …Bueller? … Bueller?