QuickFox and Murphy Security Partner on Supply Chain Security: What It Means for Users

QuickFox, operated by Xiamen Kezhensai Technology Co., Ltd., has announced a partnership with Murphy Security (墨菲安全), a well-known Chinese cybersecurity vendor specializing in software supply chain security.

The two will collaborate systematically across software composition identification, vulnerability risk detection, supply chain poisoning detection, license compliance management, and continuous supply chain risk monitoring, scoped around the product form of QuickFox’s multi-platform clients, with the aim of further improving the security and trustworthiness of those client products. 

What was announced

Who QuickFox is

QuickFox is a return-to-China VPN service released by Xiamen Kezhensai Technology Co., Ltd., serving overseas Chinese communities and Chinese students studying abroad.

It covers use cases across domestic video streaming, gaming, and live streaming, and offers clients on Windows, macOS, Android, iOS, and TV, helping overseas users access China-based content platforms smoothly. 

As a product, it shows the characteristics typical of overseas-facing internet software: multiple clients iterating in parallel, continuous version releases, delivery pipelines spanning different platform ecosystems and third-party component dependencies, and software composition that requires continuous cross-project, cross-version management.

Because it carries network transmission capabilities, its stability and security relate directly to user experience and data safety which is why every link in its software supply chain warrants rigorous treatment. 

Why this kind of product is harder to secure

For any internet product, what users see is a client, a service, a feature. Behind that product, hundreds or even thousands of open-source components and third-party dependencies may already be running.

Open-source components let development teams implement functionality quickly, and they can equally become potential entry points into the supply chain through vulnerabilities, malicious code, or version risk. 

For overseas-facing internet companies, this risk is usually distributed outside the business code in open-source dependencies, third-party SDKs, build tools, installation packages, and update pipelines.

Four traits of overseas-facing products make the scope of impact significantly harder to judge: parallel multi-platform operation, rapid version iteration, a larger number of third-party SDKs, and complex distribution channels. 

The difference becomes concrete after a release ships. Once a risky component enters a client, the impact reaches users’ local devices, overseas network environments, app stores, download sites, partner channels, and legacy versions still installed in the field.

Investigation, replacement, takedown, user outreach, and impact explanation all cost more as that surface widens. 

There is also a shift in the underlying question. Companies are no longer facing the static problem of whether a vulnerability exists, but whether they can continuously manage the software composition inside their products because open-source components keep being introduced, client versions keep iterating, and new vulnerability and poisoning intelligence keeps emerging.

A single scan at any point in time is not enough to support security operations. 

How the collaboration works

The partnership runs along four directions, shaped by the characteristics of QuickFox’s multi-platform clients. 

Software composition inventory

Continuous joint identification of open-source components, component versions, transitive dependencies, and third-party SDKs across QuickFox’s clients, progressively building relationships between projects, components, and versions so that risk assessment locates to specific clients, projects, and versions. 

Poisoning and anomalous component detection

Coverage beyond publicly disclosed vulnerabilities into malicious components, counterfeit packages, anomalous versions, and other supply chain poisoning risks so that when new malicious package information appears in the open-source ecosystem, composition data determines faster whether existing clients are involved, reducing manual investigation. 

Risk checks in development and release

Working with QuickFox’s development and delivery process to move checks earlier into dependency introduction, build, and release, with unified identification and handling rules for high-risk vulnerabilities, malicious dependencies, anomalous versions, and license risks, reducing the chance high-risk components enter official release artifacts. 

Traceable handling records

Risk discovery, impact scoping, remediation tracking, retest confirmation, and record retention forming a closed loop of continuous governance, with development, security, and release teams working from shared data for faster impact localization and remediation decisions. 

What changes

The stated significance of the partnership is moving open-source governance from a one-time scan to a continuous capability. Software composition identification, vulnerability and poisoning detection, and risk analysis and remediation are to be progressively integrated into QuickFox’s client development, build, release, and operations stages, so that security becomes an underlying capability accompanying product evolution rather than a patch applied after the fact. 

For users, that is described as more transparent software composition, more timely risk remediation, and more standardized compliance management, with the product’s security and trustworthiness continuously reinforced so that while using QuickFox to accelerate video streaming, gaming, and live streaming, there is a continuously operating supply chain security mechanism behind it. 

QuickFox has described the partnership as an important step in improving its product security system, and says it will further deepen collaboration with Murphy Security and more security organizations to continuously improve risk discovery, early warning, and response capabilities, delivering safer, more stable, and more trustworthy products and services, and jointly advancing the construction and improvement of the software supply chain security ecosystem for overseas-facing internet client products.