Loading story…
Senate Intelligence Committee Chairman Tom Cotton has formally urged the White House's top cyber official to take action against the growing risk of foreign adversaries influencing open-source software used in critical U.S. government and defense systems. In a letter to National Cyber Director Sean Cairncross, Cotton highlighted concerns about state-sponsored developers and cyber espionage groups exploiting the open, collaborative nature of open-source projects to insert malicious code, referencing incidents such as the suspected nation-state backdoor in XZ Utils and the presence of a Russia-based sole maintainer for software used by the Department of Defense.
Cotton's letter also cited the significant contributions of Chinese technology companies like Alibaba and Huawei to open-source codebases, emphasizing the need for the federal government to track the provenance and foreign influence of open-source software. The senator called for increased federal capability to monitor and mitigate these risks, noting that previous legislative efforts to improve open-source cybersecurity have stalled in Congress. The issue underscores the critical role open-source software plays in national security and the ongoing debate over how best to safeguard it from foreign manipulation.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Senate Intelligence Committee Chairman Tom Cotton sent a letter to National Cyber Director Sean Cairncross warning that foreign, especially Chinese and Russian, influence in open-source software poses national security risks to U.S. government and defense systems. He called for government-wide monitoring of software provenance and stronger assessment of adversarial contributions to OSS projects.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcenextgov.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Open-source software forms the backbone of much of today's digital infrastructure, powering browsers, applications, and critical business systems. Security leaders are increasingly aware of the risks associated with integrating open-source components into their environments, as vulnerabilities can be present even in widely used and actively maintained projects. A recent study by James Cusick at Ritsumeikan University compared the security of open-source and proprietary software by scanning millions of lines of code. The analysis revealed that large open-source projects like Chromium, despite their robust contributor communities, still contained over 1,400 potential issues, though only a few were deemed critical or high severity. In contrast, smaller open-source projects such as Genann exhibited a much higher density of potential issues, with one problem for every 27 lines of code. Proprietary software, while not immune, generally fell between these extremes, with most issues rated as medium or low severity. These findings highlight the importance of static code scanning and rigorous review processes for all software, regardless of its origin. The integration of open-source components without thorough vetting can introduce significant supply chain risks, as vulnerabilities may remain undetected and exploitable. In response to these challenges, regulatory frameworks like the European Union's Cyber Resilience Act (CRA) have been developed to enhance software security and transparency. According to Greg Kroah-Hartman, a leading Linux kernel maintainer and member of the CRA working group, the Act has evolved to be more accommodating to open-source developers. The CRA now requires producers of products with digital elements to document, secure, and maintain their software supply chains, including the generation of Software Bills of Materials (SBOMs) and proactive vulnerability management. While initial drafts of the CRA raised concerns among open-source communities about potential legal liabilities, subsequent revisions have made the regulations more palatable and beneficial for open-source contributors. Organizations like the Linux Foundation and Mozilla are required to comply with these rules, but individual contributors are generally exempt unless they are acting as commercial entities. The CRA aims to foster greater transparency and accountability in software development, ultimately benefiting both open-source and proprietary ecosystems. Security leaders are encouraged to adopt comprehensive code scanning and supply chain management practices to mitigate the risks associated with open-source software. The evolving regulatory landscape underscores the need for organizations to stay informed and proactive in addressing software security challenges. By combining technical diligence with compliance efforts, businesses can better protect themselves against the hidden risks inherent in modern software supply chains. The ongoing dialogue between regulators, open-source communities, and industry stakeholders is shaping a more resilient and secure digital environment for all.
Jun 29, 2026
National Cyber Director Sean Cairncross emphasized the urgent need for the United States to counter China's efforts to export surveillance technologies and promote a global "clean American tech stack." Speaking at the 2025 Meridian Summit, Cairncross highlighted concerns over Chinese cyber operations targeting critical US infrastructure and called for stronger messaging and engagement with international partners to deter such activities. He argued that the US has not sufficiently signaled to China that its cyber behavior is unacceptable and poses strategic risks to American interests. Simultaneously, analysis of international technical standards reveals that China has been actively shaping the protocols governing critical infrastructure worldwide by dominating standards bodies and committees. Chinese engineers and ministries have increased their influence in setting specifications for technologies such as 6G wireless, industrial automation, and port operations, giving Beijing significant leverage over global systems. This influence, combined with evidence of Chinese cyber campaigns targeting US infrastructure, underscores the strategic challenge posed by China's dual approach of technical standard-setting and cyber operations.
Jun 29, 2026
House Republican leaders have called on the Commerce Department to investigate and potentially restrict Chinese government-connected products across more than a dozen emerging industries, citing national security concerns. Their letter highlights the risks posed by Chinese technology in sectors such as artificial intelligence, energy generation, and telecommunications, warning that compromised infrastructure could threaten US economic and military stability. The lawmakers emphasize the need for a secure technology ecosystem and note that several agencies already support bans on certain Chinese products, such as TP-Link routers. Separately, congressional leaders are urging the executive branch to develop a comprehensive strategy to counter China’s influence in next-generation technologies, particularly 6G telecommunications and the broader tech supply chain. Representative Raja Krishnamoorthi has pressed federal agencies for updates on efforts to build international coalitions, shape global technical standards, and limit Chinese technology in US supply chains. These actions reflect growing bipartisan concern in Congress over the security implications of Chinese technology and the need for coordinated government action to mitigate associated risks.
Jun 29, 2026