Russian Company Gains Full Control Over Critical Open Source Easyjson Library

A startling discovery by Hunted Labs has brought to light a potential security risk lurking within the heart of the cloud-native ecosystem.

The open source Go package easyjson, widely used for optimizing JSON serialization and deserialization, has been found to be fully controlled by developers based in Moscow, employed by VK Group (also known as Mail.ru), one of Russia’s largest internet conglomerates.

VK, with ties to Russian state-owned entities and a history of compliance with Kremlin directives, raises significant concerns about the integrity of critical software dependencies like easyjson.

This package underpins major projects such as Helm, Istio, and Kubernetes, forming the backbone of modern software supply chains across U.S. Government systems and Fortune 500 enterprises.

Unveiling a Hidden Threat in the Cloud-Native Ecosystem

Through their platform Entercept, Hunted Labs identified easyjson during a routine analysis of foreign ownership and influence in software dependencies for a U.S. Government client.

Their investigation revealed that over 85% of the commits to the easyjson repository originate from VK-affiliated developers.

This level of control is alarming, given VK’s documented role in state surveillance, censorship, and information warfare, including compliance with Kremlin requests to suppress content related to Russia’s invasion of Ukraine.

The pervasive use of easyjson across thousands of open source and enterprise projects amplifies the risk, as any compromise could ripple through the cloud-native landscape.

A potential supply chain backdoor, remote code execution (RCE) via deserialization, espionage, or even a kill switch activation are among the exploitation vectors Hunted Labs warns could be weaponized, turning this seemingly innocuous library into a digital sleeper cell with catastrophic potential-from the Pentagon to consumer devices.

A Deeply Integrated Risk with Far-Reaching Implications

The technical implications of easyjson’s ownership are profound due to its deep integration and trusted-by-default nature in distributed systems.

Used for high-performance JSON handling in real-time data serialization for financial platforms and optimization of cloud-native applications, the package is both invisible and hard to remove, making it an ideal target for subtle sabotage.

Hunted Labs’ methodology involved reverse-engineering dependency chains across 2,500 images and repositories, uncovering easyjson’s footprint in critical projects.

Their Blast Radius tool visually mapped its interconnectedness, while threat search features confirmed thousands of direct and indirect dependencies.

This raises a critical question: how did such a widely-used component, maintained by a state-influenced entity under U.S. and E.U. sanctions, evade scrutiny for so long?

The answer lies in the implicit trust and lack of vetting often afforded to open source software, which prioritizes speed over security.

As Hunted Labs emphasizes, understanding who writes the code behind essential libraries is no longer optional but a vital step in securing global software ecosystems.

Their findings urge immediate due diligence and a reevaluation of dependency risks in cloud infrastructure.

Setting Up SOC Team? – Download Free Ultimate SIEM Pricing Guide (PDF) For Your SOC Team -> Free Download