A new study from Purdue University examined over 220 apps marketed to US troops, revealing that a significant portion contains third-party code, or SDKs, with origins in countries including China and Russia.

Researchers found that 64 percent of these apps incorporated SDKs, which can track user behavior and location. Alarmingly, 40 percent of the apps collected or shared more data than disclosed. While common SDKs from Google and Facebook were prevalent, the study identified 76 different SDKs in total, with some traced back to adversarial nations.

Specifically, 12 apps included Huawei's HMS Core, a software kit capable of mapping user locations and delivering ads. In one instance, this code was added without the developer's explicit knowledge. While no data was observed being sent to Huawei servers, the potential for remote updates means dormant code could become a security risk.