Putin on the code: DoD reportedly relies on utility written by Russia-based Yandex dev A Node.js utility used by thousands of public projects - and more than 30 Department of Defense ones - appears to have a sole maintainer whose online profiles identify him as a Yandex employee living in Russia. US cybersecurity firm Hunted Labs reported the revelations on Wednesday. The utility in question is fast-glob, which …
Surely the vulnerability here is not that the code was written by someone you don't control, but rather that the general practice in the JS world (just pulling everything from "source" rather than taking a trusted, local copy) allows them to change it without you knowing.
Who really does it? The fact tha billion of eyes peruse open source code every day is a myth. You would need people just doing that as their full-time job - and nobody likes to do that.
The real problem is what you get for free comes with no warrant, from somone, somewhere. And since noone can compete with free stuff, it's hard to find now a more trustworthy supply chain.
This library is no more an injection risk than any other. While the dev would theoretically be more easily coerced to poison it by the Russian government, the change would also be more obvious from a small library (therefore large code changes to add something malicious are more noticeable) and single developer. The problem is not that this little piece of open source code is written by someone in Russia; there's far more code written by people in Russia. The problem is loading code into anywhere sensitive without having some reason to think that it's secure or that there are precautions in place if it turns out not to be.
If Russia wants to do a supply chain attack, they have a lot of NPM modules they can choose. Many of them are much larger and not well-maintained, so if they can trick the one developer into accepting their updates, they could do similar things. They could easily decide that fast-glob looks like a nice one to do it to, unless articles like this one result in more scrutiny on that package or its removal. There's a lot more important aspects than a dev living in Russia to determining the risk or damage of that happening.
While I can't say anything about this particular package, I'd expect, as a developer who's worked in the Node.js ecosystem, that any sensible dev check installed npm packages (and yes, this doesn't only apply to npm) and which dependencies those packages have in turn, and so on. It's not rocket science, just basic code hygiene... Oh, you don't got time? Well, maybe don't use that sketchy package in your code, because it will cost you and your business more time when it gets pwned.
Of course, different developers have different security requirements on a project basis, but from my personal experience the projects I work on has very stringent security needs.
> Simplest solution for the thousands of projects using fast-glob would be for Malinochkin to add additional maintainers and enhance project oversight, as the only other alternative would be for anyone using it to find a suitable replacement.
The *only* other alternative?
Not, keeping a known copy in your own system? Along with the rest of the code you are relying on?
Not, gathering a group of Trustworthy True Red, White and Blue Pure Hearted US Patriots who can make a simple fork (and offer Malinochkin tech leadership rights, but take on anything more onerous or tedious wrt managing a popular package, to make life easier for him as well?)
Not, offering to help the sole developer who has the misfortune to write something useful for you ungrateful bastards? Oh no, Malinochkin has to take all the initiative.
Not only has nobody learnt anything from things like the left-pad incident?* but anyone who actually does something good as a sole dev is now to be a suspected security hole and it is all their fault!
* Oh, but Azer Koçulu - that doesn't sound like a white US male's name, he was suspect all along.
... and mitigating it.
Not your personal army.
Code developed by someone claiming to live in a different country than Russia is not more trustworthy simply due to this claim (or fact). This is simple fear mongering and headline-grabbing from Hunting Labs.
If you copy stuff from the Internet that someone else took the effort to code and use it for free, you _can_ at least be bothered to read it to make sure it does what you expect. Or to pay someone to read it. Or to pay a company to repackage it, make sure it works and interoperates as expected.
The Open Source community as a whole will never agree to the nation-based and US-centric threat model of the US DoD and Hunting Labs.
If anything, the npm dependency mechanism is a security problem. But not a single developer from Russia.
My colleague Mr. Malinochkin and I, and a lot of other people, write open-source software. We're trying to provide something useful to the world.
I am doing so from the US. I've never been told by my government to insert particular code. Then again,
- my code isn't that widely used outside some specialized areas and
- I can hear every one of you thinking "he would say that, wouldn't he?" [0]
Both Mr. Malinochkin and I live in regimes where we might be told to mangle our code. Anybody using our code has to take that into account.
Beyond that, plenty of people working at Google, Apple, Microsoft, etc. have relatives in China and Russia. I'm sure the spy agencies of those countries have thought about saying "nice bunch of relatives you have back here; it'd be a shame if something happened to them." And the companies involved produce closed source, providing greater opportunity for skulduggery.
Bottom line : you can't trust anybody these days. Including me. Or Mr. Malinochkin. And you already had plenty of reasons not to trust Google et. al. anyway.
[0] Were I served an NSL... well, I might "say that". I have a family to think of. But I'd also consider it my obligation, to users of my code and to my country, to resist it as far as possible.
An American Developer being confronted with a "nice bunch of relatives you have here; it'd be a shame if some ICE raid happened to them." is also not a completely unrealistic scenario in the 2025-version of a U.S. where the government ignores or even outright breaks the law, soldiers patrol cities and masked militias snatch people off the street and make them disappear.
From an external, European perspective, the U.S. have become the evil they proclaimed to fight since WW2.
So I agree:
You cannot trust or distrust anyone based on nationality or on past performance, because blackmail may be applied by many governments nowadays.
At least with Open Source you can conduct code reviews.
Out of curiosity, I cloned the git repo and counted the lines in all files, comments, warts, and all. A bit less than 23K total, a bit less then 7.5K in the src directory. It doesn't look beyond the capabilities of the DoD, or any of its 30 individual projects mentioned in the article, to validate that, if the package is genuinely useful. Once. When updates are pulled in one would need to look at the diffs. Mirror the repo (all the needed open source repos?) in a controlled location and forbid pulling directly from anywhere else. DoD people can follow orders, right?
Then, again assuming the package is genuinely useful and noticeably better than the alternatives, maybe discreetly suggest to the author to take a personal trip to, say, Turkey or Finland to be interviewed and vetted for a job? On, no, forget I said that...
Always a shame when one first starts losing faith in something or somebody. With news organisations it's normally ill-considered, prejudiced reporting, parroting someone with an agenda that does it for me.
Assuming that this is somehow newsworthy (unconvinced), then maybe let one of the grown-ups write a balanced and insightful account next time. Or read the many such comments above and do that now.
This is the most xenophobic article I’ve read for a long time.
There is a valuable lesson somewhere in here about trust, peer review, or reliance on auto-loading code from third party repositories — but please let’s not descend into unbridled xenophobia just because the sole maintainer of a widely used project happens to be Russian.
Hunting Labs wanted a headline and some kind of relevance so they found an isolated dev to pick on. The message here is that if you happen to donate your time to an open source project and you're the main dev or god forbid only dev, you'd better live in the US. Otherwise irrelevant security companies and credulous reporters will point their finger at you and yell "UR a DANGER!!".
There's lots of one person OS projects. Many start that way and plenty stay that way forever.
This is really cynical, lazy work.
