More than 40% of “dangerous” apps on Apple and Google’s app stores were made by American developers, according to a report published by online security firm Marble Labs.

Dangerous? The report refers to “malicious and risky” apps that take liberties with their users’ personal data, including sending their private data or uploading their contacts to remote servers without telling them, and sending their browser history over the internet.

However, at the more extreme end of the spectrum, its definition includes apps that defraud people with premium-rate text messages, lead them to malicious phishing websites, or install extra apps to show unwanted advertisements.

According to Marble Labs, the fact that 42% of “dangerous” apps come from American developers was a surprise to its analysts, who scanned more than 1m Android and iOS apps as part of the study.

“While China, Korea, India and Taiwan generate a great number of malicious and risky apps, their combined total doesn’t amount to that of the United States,” claimed the report.

“It is a commonly held belief that Chinese or Russian app developers are responsible for the majority of malicious and highly risky apps. While that may be true for malware that targets jailbroken iPhones or rooted Android mobile devices, when we looked at apps that are available on legitimate app stores for non-tampered devices, the story is very different.”

The US may be responsible for the largest number of worrying apps according to the research, but that’s partly because of the high number of apps being developed in that country.

The report includes a second table ranked by the “likelihood that an app from these countries is malicious or highly risky” – in other words, what percentage of apps developed in those countries provide cause for concern.

Marble Labs claims that on these grounds, China is the riskiest country, with nearly 9% of apps originating there triggering its dangerometer. Taiwan with 7% and Singapore with just over 4% are second and third in that chart, with only just over 1% of American-developed apps causing concern.

It’s important to think about the different grades of danger, too. Uploading someone’s contacts to a server without telling them is a serious privacy intrusion, but in many cases it’s due to a developer not understanding (or wilfully disobeying) privacy laws in their country, rather than full-blown cybercrime.

It’s still a problem – a study by the pan-governmental Global Privacy Enforcement Network in September 2014 claimed that 85% of apps are failing to clearly explain how they collect, use and disclose personal information – but it’s not the same level of danger as apps developed with malicious intent to steal personal data, install malware and/or defraud users.