Apps Marketed to US Troops Are Shipping Chinese and Russian Code

A groundbreaking security analysis has revealed that over one in eight mobile apps designed for US service members include code from Chinese and Russian software firms, according to WIRED. This is not just a Pentagon problem. It shows how invisible the modern software supply chain has become, even for apps targeting security-conscious users.

The finding matters because these are not generic consumer apps. They are marketed specifically to military personnel for everything from fitness tracking to financial management. Yet the developers behind them are pulling in third-party code libraries and SDKs without full transparency about where that code originates or what data it touches.

China and Russia are officially designated as adversary nations by the US Department of Defense. Code from firms in those countries creates potential vectors for surveillance, data exfiltration, or influence operations. Even if the code itself is benign, the lack of visibility is the real vulnerability. Most app developers do not audit their dependencies deeply enough to know what is actually running.

This is part of a broader supply chain security crisis in software. Open source libraries, analytics SDKs, and ad networks are often nested several layers deep. A developer might trust a US-based analytics provider, not realizing that provider uses a Chinese-owned data pipeline under the hood. The result is a blind spot that extends from consumer apps all the way to tools used by people with security clearances.

The report did not name specific apps or provide download figures, but the scale is significant enough to warrant attention from both the Pentagon and the broader tech industry. If apps for military users have this problem, enterprise and consumer apps almost certainly do too.

What this means for you: if you are building or buying software for any security-sensitive environment, you need to demand a software bill of materials (SBOM) that maps every dependency and its origin. For teams evaluating tools, try this prompt with an AI assistant: "Analyze this list of dependencies from our package.json and flag any that originate from companies based in China, Russia, or other high-risk jurisdictions. For each flagged dependency, suggest a comparable alternative from a trusted source." Knowing what is in your stack is the first step to controlling it.