Senate Intelligence Chairman Sounds Alarm on Foreign Adversary Infiltration of Open-Source Software

Breached Company

20 Dec 2025 — 10 min read

Senator Tom Cotton warns that China and Russia are systematically exploiting trust-based OSS ecosystem to compromise U.S. defense systems

December 20, 2025 — In a stark warning to the nation's top cybersecurity official, Senate Intelligence Committee Chairman Tom Cotton has outlined what he calls a "critical national security risk" stemming from foreign adversary involvement in the open-source software ecosystem that underpins American defense systems.

The Arkansas Republican's December 17 letter to National Cyber Director Sean Cairncross details a disturbing pattern: state-sponsored developers from China and Russia are leveraging the collaborative, trust-based nature of open-source development to position themselves for potential supply chain attacks against U.S. government systems, including those used by the Department of Defense.

The Trust Paradox at the Heart of Open Source

Cotton's letter illuminates a fundamental tension in modern software development. Open-source software has become the backbone of digital infrastructure precisely because it relies on a global community of contributors working under an assumption of benevolent participation. This same openness, however, creates opportunities for adversaries willing to play the long game.

"OSS relies on a trust-based, global community of contributors to ensure that software stays accessible, secure, and updated," Cotton wrote. "Unfortunately, there are reports that state-sponsored software developers and cyber espionage groups have started to exploit this communal environment, which assumes that contributors are benevolent, to insert malicious code into widely used open source codebases."

The letter specifically cites three concerning developments:

The XZ Utils Backdoor: In early 2024, security researcher Andres Freund discovered a sophisticated backdoor in XZ Utils, a critical compression library used across Linux distributions. The malicious code was inserted by an actor known as "Jia Tan," who spent nearly three years building credibility within the project before introducing the backdoor in versions 5.6.0 and 5.6.1.

The XZ incident represents perhaps the most sophisticated open-source supply chain attack discovered to date. Jia Tan engaged in an elaborate social engineering campaign, using apparent sock puppet accounts to pressure the project's maintainer to grant commit access. Once in position, Jia Tan carefully inserted malicious code that would have given attackers remote code execution capabilities on systems using compromised SSH implementations.

Security experts noted the backdoor was discovered largely by luck—Freund noticed unusual CPU usage during routine testing. Had it remained undetected and made its way into stable Linux distributions, it could have provided attackers with a "master key" to hundreds of millions of systems worldwide.

The fast-glob Concern: Perhaps more immediately troubling is the revelation that a Russia-based Yandex employee serves as the sole maintainer of fast-glob, an open-source utility embedded in at least 30 Department of Defense software packages. The package is downloaded approximately 70 million times per week and is used in over 5,000 public projects.

While there is currently no evidence of malicious activity, cybersecurity researchers from Hunted Labs warned that the maintainer, Denis Malinochkin, "is more likely to encounter [Russia's Federal Security Service] or state security individuals in their day-to-day duties and could be susceptible to coercion." The package is listed in Platform One's Iron Bank, the Pentagon's vetted repository of software building blocks.

Malinochkin has maintained the project for over seven years and stated that "nobody has ever asked me to manipulate fast-glob, introduce hidden changes to the project, or collect and share system data." However, the structural vulnerability remains: a single maintainer with potential exposure to state coercion controls code embedded in defense systems.

Chinese Corporate Contributions: Cotton also highlighted that Chinese technology giants Alibaba and Huawei rank among the top 20 contributors worldwide in the Open Source Contributor Index. Given that China's national security laws compel companies to provide technical assistance to further government objectives, this raises questions about the strategic positioning of Chinese entities within critical open-source projects.

A Systematic Vulnerability Across Government Systems

The implications extend far beyond individual packages. Cotton emphasized that open-source software forms the backbone of U.S. government systems, including mission-critical defense infrastructure. The government leverages OSS to innovate, develop, and deploy technology quickly—but this speed comes with risk when the provenance and motivations of contributors remain opaque.

"Leaving our reliance on OSS unmonitored is exposing America to increasingly dangerous risks," Cotton wrote in his letter.

The senator pointed to Defense Secretary Pete Hegseth's July 2025 memorandum directing the Department of Defense to "not procure any hardware or software susceptible to adversarial foreign influence" and to "prevent such adversaries from introducing malicious capabilities into the products and services utilized by the department." Cotton's letter suggests that memo remains more aspiration than reality.

The Scale of the Problem

Understanding the true scope of foreign influence in open-source ecosystems requires grappling with some stark realities:

Open-source components make up the majority of code in modern software applications
Critical infrastructure projects often depend on code maintained by small teams or even individual volunteers
The federal government frequently lacks visibility into the full dependency tree of software it uses
Updates and patches flow continuously, often with minimal vetting beyond known vulnerability scanning

John Scott, senior vice president of Rivada Select Services, told Information Security Media Group that the government "doesn't understand what OSS they have or IT coming over the transom in any meaningful way to assess risk. It gets worse when patches and updates come in weekly, with little vetting beyond known software vulnerabilities, so all the unknowns come in with unknown provenance."

Cotton's Call to Action

The senator's letter requests that the Office of the National Cyber Director take concrete steps to address this vulnerability:

Build federal capability to maintain awareness of open-source software provenance
Track foreign influence on OSS projects
Monitor contributions from developers in adversary nations
Coordinate government-wide cybersecurity policy on open-source risk

Cotton positioned the ONCD as uniquely positioned to lead this effort, given its mandate to coordinate implementation of national cyber policy across government.

The Broader Context: Supply Chain as Battleground

This warning arrives amid growing recognition that software supply chains represent a critical national security battleground. China, Russia, North Korea, and Iran have all demonstrated sophisticated capabilities in supply chain attacks.

Research from Strider Technologies earlier in 2025 found that state-affiliated hackers from these nations are covertly working to insert backdoors and exploits into major publicly-available software used by organizations and governments worldwide.

The challenge is particularly acute because adversaries can afford to play the long game. The XZ Utils attack demonstrated a willingness to spend years building credibility before striking. This patient approach exploits the very mechanisms that make open-source software successful: community trust, distributed development, and meritocratic contribution models.

The Open-Source Community's Dilemma

Cotton's letter has sparked debate within the cybersecurity and open-source communities about how to balance security with the collaborative ethos that makes open source powerful.

Some developers have expressed frustration at the implication that maintainers should be judged based on nationality or employer rather than code quality. The maintainer of fast-glob emphasized that the source code is "fully open and auditable by potential users" and that open source "is built on trust and diversity."

Others argue that the national security implications are too serious to ignore, particularly for software embedded in defense systems. The debate highlights a fundamental question: Can the open-source model survive in an era of great power competition where adversaries view software supply chains as legitimate targets?

What This Means for Security Practitioners

For CISOs and security teams, Cotton's letter underscores several critical imperatives:

Implement Software Bill of Materials (SBOM) practices: Understanding the full dependency tree of your software stack is no longer optional. Organizations need visibility into not just direct dependencies but the entire chain of components.

Assess maintainer risk: While nationality alone shouldn't disqualify contributors, the combination of single-maintainer projects, lack of oversight, and potential state coercion creates genuine risk that must be evaluated.

Diversify critical dependencies: Where possible, avoid sole dependence on projects controlled by individuals in adversary nations, particularly for security-critical applications.

Participate in securing the ecosystem: Organizations that depend heavily on open-source software should consider contributing resources to security audits, supporting maintainer diversification, and funding security-focused development.

Monitor for anomalies: The XZ Utils backdoor was discovered because someone noticed unusual behavior. Continuous monitoring and behavioral analysis of critical components can provide early warning of compromise.

The Path Forward

Cotton's letter is unlikely to result in immediate policy changes, but it signals growing congressional awareness of open-source supply chain risks. Previous attempts at legislation to improve open-source cybersecurity stalled in the Senate in 2023.

The challenge facing policymakers is how to address legitimate security concerns without undermining the open-source ecosystem that has become essential to American technological competitiveness. Heavy-handed restrictions could drive talent away from open-source development or fragment the ecosystem into geopolitically-aligned forks.

More sophisticated approaches might include:

Enhanced vetting for defense-critical software without attempting to regulate all open source
Investment in automated security analysis tools that can detect suspicious code changes
Support for maintainer communities to reduce dependence on single individuals
Transparency requirements for software used in government systems
International cooperation on open-source security standards among allied nations

Conclusion: Trust, But Verify—At Scale

Senator Cotton's warning highlights a fundamental challenge of the digital age: the software that runs critical infrastructure is built by a global community of contributors whose motivations and allegiances may not align with U.S. interests.

The XZ Utils incident proved that sophisticated adversaries are already exploiting the trust-based nature of open-source development. The fast-glob situation demonstrates that potential vulnerabilities exist right now in defense systems. Chinese and Russian strategic positioning in major open-source projects suggests long-term planning to influence critical infrastructure.

The solution is not to abandon open source—that would be both impossible and counterproductive. Instead, the security community must develop the tools, processes, and institutional capabilities to maintain the benefits of open collaboration while defending against adversarial exploitation.

This requires a shift from implicit trust to rigorous verification at scale. It demands investment in security tooling, maintainer support, and dependency visibility. Most importantly, it necessitates recognition that open-source software security is not just a technical challenge but a national security imperative.

Cotton's letter to the National Cyber Director represents a call to action. The question now is whether the government can develop the capabilities to secure the open-source ecosystem before adversaries exploit the vulnerabilities that Cotton has so clearly outlined.