When the XZ Utils backdoor was discovered in March 2024, it validated what we long feared: sophisticated actors are systematically targeting the trust mechanisms of open source. Patient adversaries are willing to spend years building credibility within projects before introducing malicious code that could ripple throughout global infrastructure.
We founded Hunted Labs in direct response to this reality. There were tools for organizations to identify and review vulnerabilities and misconfigurations, but there was no way to evaluate who was behind critical open source code, no ability to measure contributor risk, assess potential for coercion, or map ownership and control in dependencies. This is the intelligence gap we fill.
In reports like easyjson and fast-glob, we uncovered critical dependencies controlled by foreign organizations with ties to hostile states. These packages are deeply embedded across government, finance, and infrastructure, yet their risks remain largely invisible to existing security models.
Our reports sparked intense debate within the community, like on Hacker News, where someone said, “If who wrote some code matters to you, then your supply chain management is simply insufficient.” We disagree. This popular sentiment underestimates human weakness, nihilism, and criminal behavior. It doesn’t take into account the compromise of maintainer accounts, straight-up phishing attacks, coercion, or subtle sabotage that could go undetected for years.
The open source community’s greatest strength—its openness and trust—has become a systematic vulnerability that can be exploited. The community must evolve to match the sophistication of adversaries, their covert tactics, and the complexity of software supply chains.
The dependency on open source in every critical piece of technology, from defense to banking and critical infrastructure, creates an attack surface of foreign/malign ownership, control, and influence that extends beyond traditional cybersecurity boundaries. When a single package like leftpad can break thousands of applications, or when a backdoor in compression utilities can threaten global infrastructure, we’re operating in a threat landscape that existing security models weren’t designed to handle.
We’re not suggesting that all foreign developers are suspect, or that nationality alone determines trustworthiness. Criminals come in all types. Our concern is structural: When critical infrastructure depends on packages maintained by individuals who, regardless of where they live, could be subject to state coercion—whether through legal frameworks, economic pressure, or direct intimidation—or act on their own ulterior motives, the industry needs better tools to assess and manage that risk.
We anchor everything we do—our research, our products, our investigations—on a core set of guiding principles. These are not abstract ideals; they are the framework we believe is necessary to defend the open source ecosystem and the critical systems built on top of it.
