Daily Brief: 19 December 2025
Software built on 97% borrowed code faces 1,300% more attacks. China and Russia's 8,500-word "partnership" can't hide who's really in charge.
Global | Technology | Software supply chain attacks surge 1,300% as dependency architecture creates systemic vulnerabilities
Situation
Modern software applications contain 85-97% third-party code from open-source libraries, frameworks, and external APIs. This dependency pyramid extends trust through thousands of components maintained by volunteers and strangers that no single organization can verify.
Software supply chain attacks doubled in 2023, with 245,032 malicious packages uploaded to public repositories—reflecting a 1,300% increase since 2020. The SolarWinds breach compromised 18,000 organizations through a single corrupted update, while the xz Utils backdoor nearly compromised SSH authentication across global Linux systems.
Critical infrastructure depends on libraries maintained by handful of unpaid volunteers. The core-js library used by 75% of top websites was maintained by one developer facing financial crisis.
Context
Traditional security models assume trusted vendors deliver trustworthy code, but attackers now exploit trust relationships rather than technical vulnerabilities. Zero-trust architectures cannot detect malicious code legitimately signed by compromised vendors.
The economics favor dependency over security. Building from scratch costs ten times more, so markets reward companies using open-source ecosystems representing billions in donated labor. However, benefits of secure infrastructure are diffuse while costs of insecurity are externalized.
Concentration amplifies risk. Three cloud providers host majority of enterprise workloads, while handful of platforms distribute most open-source libraries. When npm experiences outages, thousands of build pipelines fail simultaneously, revealing interconnected vulnerabilities.
Trajectory
Trust itself has become the primary attack surface in digital infrastructure. Attackers can achieve massive scale by compromising single popular libraries rather than individual targets, fundamentally changing the economics of cybersecurity.
The maintainer crisis will worsen as commercial dependency on volunteer-maintained code grows. Current funding efforts reach only a fraction of the 200+ projects critical to global software supply chains.
Organizations must shift from perimeter-based security to supply chain verification, but structural market failures mean individual companies cannot solve systemic risks created by shared dependencies and concentrated platforms.
China | Russia | Strategic partnership masks deepening asymmetry and competing regional interests
Situation
The May 2024 Xi-Putin agreement spanning 8,500 words promised extensive cooperation across trade, energy, and technology. Despite Western characterization as an alliance, the relationship operates on strategic convenience rather than shared vision.
Russia’s economic dependency has intensified, with China’s economy now ten times larger. Moscow sells raw materials while importing Chinese manufactured goods and components previously sourced from the West. The stalled Power of Siberia 2 pipeline negotiations exemplify Beijing’s leverage over pricing and terms.
Territorial and demographic imbalances persist along their 4,200-kilometer border, with Russia’s Far East holding 36% of territory but only 4% of population, while China’s northeastern provinces contain 110 million people.
Context
Central Asia reveals the clearest competition, where Chinese trade with the five regional states exceeds Russian trade by factor three. Beijing’s Belt and Road infrastructure investment dwarfs Moscow’s capacity, threatening Russia’s historical sphere of influence through economic penetration rather than military force.
Fundamental strategic cultures diverge. Russia’s approach emphasizes chaos and plausible deniability, while China demands ideological clarity and centralized control. Putin’s legitimacy relies on resentment against Western humiliation; Xi’s depends on restoration narratives and national rejuvenation.
Technology transfer remains contentious, with Russia maintaining caution after China reverse-engineered military systems like the Su-27 fighter. Trust deficits persist despite partnership rhetoric.
Trajectory
Western attempts to exploit these tensions face legal and practical constraints. Heavy-handed interference would likely strengthen Moscow-Beijing cooperation by validating their encirclement narratives.
The relationship’s transactional nature suggests inherent instability as power asymmetries deepen. China’s patient approach to negotiations signals confidence in long-term leverage trends.
Success requires creating conditions where existing fractures naturally widen, rather than direct intervention. The Nixon-era China opening succeeded by exploiting existing Sino-Soviet tensions, not manufacturing them.
Until tomorrow.
