May 6, 2025 A widely used open-source Go library, easyjson, used in healthcare, finance and even defence has come under scrutiny after cybersecurity firm Hunted Labs revealed its deep ties to a sanctioned Russian company, the VK Group. The tool, integral to numerous U.S. government and enterprise systems, is maintained by developers based in Moscow, raising concerns about potential exploitation by Russian state actors.

easyjson is a JSON serialization library for the Go programming language, employed extensively across cloud-native infrastructures. Hunted Labs’ investigation uncovered that the library is hosted on GitHub under Mail.ru, a subsidiary of VK Group, whose CEO, Vladimir Kiriyenko, is sanctioned by the U.S. and EU. While no vulnerabilities have been detected, the potential for future compromise is significant, given the library’s pervasive use in critical sectors like defense, finance, and healthcare .

Experts warn that easyjson could serve as a “sleeper cell,” enabling supply chain attacks, data exfiltration, or system disruptions if manipulated. Its integration into essential tools like Kubernetes, Prometheus, and Grafana amplifies the risk, as any compromise could cascade through dependent systems.

The situation underscores the need for heightened vigilance in assessing the provenance of open-source software. Organizations are advised to audit their dependencies, consider forking critical libraries to ensure control, and implement robust monitoring to detect anomalous activities. As the open-source ecosystem remains a cornerstone of modern infrastructure, ensuring its integrity is paramount to national and organizational security.

Just how this tool can be replaced is no easy feat given how prevalent it is in so many open source packages and tools.