Putin on the code: DoD reportedly relies on utility written by Russia-based Yandex dev

A report highlights supply chain risk concerns about the Node.js package fast-glob, which is widely used (including in DoD projects) and maintained by a single developer identified as a Yandex employee in Russia. While no CVEs, compromises, or threat actor ties are reported and the maintainer denies any malicious activity, the potential for exploitation due to deep system access is noted; recommended mitigations include adding maintainers and improving oversight or replacing the package.