THE RUSSIAN OPEN SOURCE PROJECT THAT WE CAN'T LIVE WITHOUT

Summary from the TLDR InfoSec newsletter

The widely used easyjson Golang JSON deserialization library is owned, maintained, and controlled by the VK Group. Russian state-owned entities control the VK Group, and it has leadership that is subject to US and EU sanctions. There is high potential for exploitation as the package is widely used in CNCF projects such as Helm, Istio, and Kubernetes.