The Front Line Is in Your Pocket Researchers found Huawei code in an app U.S. troops use to review their own barracks. That's not a separate story from Taiwan.
America just found Chinese and Russian code in apps built for its own troops. That story and the week's Taiwan headlines aren't neighbors on a news rundown — they're the same story wearing different hats.
Here's a sentence that should not exist in 2026: researchers examining apps made specifically for U.S. service members — not apps troops happen to use, but apps marketed to them, built for them — found that more than one in eight contain code from Chinese and Russian software firms. Some of those firms operate in countries the Pentagon formally designates as adversaries.
One in eight. Picture learning that one in eight locks in your house was installed by the neighbor who keeps asking what time you leave for work. You wouldn't call that a hardware issue. You'd call a locksmith — and probably the police.
The analysis — conducted by researchers at Purdue University, Florida International University, and the U.S. Military Academy at West Point (yes, the military's own academy helped uncover this) and reported by Wired — is the first systematic look at the military app supply chain, and the details are the kind that make you want to lie down. We're talking about fitness trackers troops use to log PT requirements. Deployment communication tools. Benefits calculators. The digital plumbing of military life, quietly assembled — like nearly all modern software — from third-party components, some of which trace back to companies answerable to Beijing or Moscow.
The standout example deserves its own moment of silence: a popular app service members use to review the conditions of their own base housing turned out to contain code from Huawei. Yes, that Huawei — the Chinese telecom U.S. regulators formally branded a national security threat back in 2020. Troops rating their barracks on software carrying code from a company the government itself declared too dangerous for American networks. Two other apps, the researchers found, were built by Russian companies outright and carry code from Yandex, the Russian ad service.
Now, the honest part, because we don't do panic here: nobody has shown this code was planted, and nobody has shown it's been exploited. Most of it is probabl
there for the same reason foreign code is in everything — developers grab off-the-shelf software kits the way the rest of us grab shopping carts, without checking the wheels. This is not, as far as anyone can prove, a spy operation.
It's arguably worse. It's nobody checking.
Because here's the structural problem: under Chinese national security law — and under Russian data law — companies can be compelled to cooperate with state authorities. The code doesn't have to be malicious today. The company behind it just has to pick up the phone when the government calls tomorrow. That's the entire logic behind banning Huawei from telecom networks and TikTok from government phones. We held congressional hearings. We made a whole national moment of it. And then we let apps aimed at people in uniform ship with adversary-linked dependencies that nobody audited, because software supply chains are boring and hardware supply chains get all the glamour.
The Pentagon has spent years X-raying Chinese-made chips and yanking suspect telecom gear out of networks. Meanwhile, the apps got a shrug. The NSA and CISA have published supply-chain guidance; enforcement has been, let's say, aspirational. The fix everyone's now demanding — mandatory software bills of materials, essentially a nutrition label telling you what's actually inside the code — is a genuinely good idea whose most damning feature is that it doesn't already exist.
Meanwhile, in the Pacific
Hold that thought, because the same week this landed, three other stories broke that look unrelated and absolutely are not.
One. Taiwanese President Lai Ching-te stood before his party's annual congress on July 19 and urged members to resist the "red terror" coming from Beijing — pointing not to missiles but to legal warfare: a new Chinese ethnic-unity law that Taipei fears gives Beijing a pretext to pursue people it deems separatists beyond China's own borders. Lai's warning, delivered pointedly in Taiwanese rather than Mandarin, was that democratic Taiwan must never be turned into "China's Taiwan" — and that the pressure now arrives through statutes and paperwork as much as through fighter jets.
Two. On July 16, Papua New Guinea abruptly ordered Taiwan's economic office in Port Moresby closed, declaring that Taiwan's physical presence would no longer be recognized in the country. Beijing praised the move within hours, which is the diplomatic equivalent of applauding before the curtain finishes falling. Taipei said it wasn't consulted, lodged a protest, and — in a small act of defiance I genuinely admire — kept picking up the phone at the supposedly closed office. Washington called it part of Beijing's intimidation campaign. Analysts noted PNG may have been smoothing things over with China after signing a defense treaty with Australia last year, which means Taiwan's diplomatic presence was traded away like a rewards-card discount.
Three. Taiwan's drone coalition — the Taiwan Excellence Drone International Business Opportunities Alliance, or TEDIBOA, because every alliance needs an acronym only its mother could love — is racing to lock down what Taipei calls a "non-red" supply chain: drones built without a single Chinese component. The alliance now spans more than 260 companies and has signed agreements with counterparts in eight countries, including the United States, Japan, Poland, Ukraine, and the Baltic states. The government is backing it with a four-year investment north of a billion dollars and plans to procure roughly 50,000 military drones from domestic makers by 2027 — and it's working: Taiwan's drone exports in the first quarter of this year already exceeded all of last year's total. Because Taiwan looked at the global drone industry, noticed that China dominates the component supply chain top to bottom, and concluded that fighting a drone war with parts made by the country you'd be fighting is not, strictly speaking, a strategy
It's dependencies all the way down
See it yet? Every one of these stories is about the same weapon, and the weapon is dependency.
Foreign code buried in military apps is a dependency. A Pacific nation's economic relationship with Beijing — leveraged to erase Taiwan's presence from Port Moresby — is a dependency. Chinese-made drone components are a dependency. Even the PNG story is secretly a supply-line story: the country sits directly on the maritime corridors that carry energy toward Taiwan. Beijing didn't just close an office. It tightened a grip on a chokepoint.
And here's the uncomfortable mirror: Taiwan — the place with actual missiles pointed at it — has internalized this lesson. It's auditing its dependencies, building coalitions to replace Chinese components, and treating supply chains as the battlefield they are. The United States, meanwhile, just learned from a magazine investigation that its troops' PT apps are stitched together with code from countries it officially considers adversaries.
The nation under existential threat is doing supplychain hygiene. The superpower is doing app-store archaeology. After the fact.
To be clear about what this is and isn't: there's no evidence these stories share an author. Nobody in Beijing coordinated a PT app's software kit with a foreign ministry statement in Port Moresby. The connection isn't a plot. It's a doctrine — one that says you don't need to fire a shot at an adversary you're already inside of. Inside its software, its component supply, its neighbors' balance sheets. The contest over Taiwan, and increasingly over the whole Pacific, is being waged in the unglamorous fine print: code libraries, shipping lanes, procurement contracts, legal statutes.
Lai told his party that democracy is strength, not weakness. Maybe. But democracies have a specific weakness, and it's that we treat boring things as safe things. Nobody holds a hearing about a software development kit. There's no ribbon-cutting for a component audit. The threats we mobilize against are the ones that make good television — a balloon, an app with a dance-video algorithm — while the quiet dependencies accumulate underneath.
Every headline this week was about someone choosing, or refusing, to depend on Beijing. Papua New Guinea chose. Taiwan is refusing, at cost and at speed. And the U.S. military just discovered it made the choice years ago, by default, one unread line of code at a time
The war over the Pacific may never be declared. Parts of it have already been installed.