Researchers warn that open-source Go serialization tool easyjson, owned by Russia's VK Group and used by the US DOD and others, poses a national security risk
The open source software easyjson is used by the US government and American companies. But its ties to Russia's VK …
Context & Ripple Effects
The warning places easyjson in a broader supply-chain security debate: open-source dependencies can be widely embedded in government and commercial software even when maintainership or ownership sits outside those users’ normal procurement controls.
It follows heightened concern after the attempted XZ Utils backdoor and parallels reporting on a Russia-based maintainer of the fast-glob tool used in US Defense Department packages. The immediate issue is not a confirmed compromise, but whether dependency provenance and governance receive enough scrutiny.
First-order effects
- US government users and American companies relying on easyjson may need to identify where it is embedded and assess the exposure associated with VK Group’s ownership.
- Security and procurement teams face a governance review of a dependency that may have entered products indirectly rather than through a direct vendor purchase.
Second-order effects
- Software vendors and downstream users may be pressed to document dependency provenance and provide replacement or mitigation paths where sensitive customers flag easyjson.
- The case reinforces demand for tooling and processes that map open-source components, complementing prior efforts to expand open-source vulnerability databases beyond individual projects’ disclosures.
Third-order effects
- If organizations treat ownership and maintainer jurisdiction as supply-chain risk factors alongside technical vulnerabilities, open-source adoption in sensitive systems could increasingly be shaped by provenance requirements.
- That could shift responsibility toward maintainers, package ecosystems, and procuring agencies to make dependency governance more transparent—though the reporting does not establish that easyjson itself has been compromised.
The trend: Open-source supply-chain security is expanding from finding code flaws to evaluating who governs critical dependencies and under which jurisdiction.