# Securing the

AI security researcher, open-source maintainer, and author. Explore Liran Tal’s blog, research papers, developer tools, books, and conference talks.

Canonical: https://lirantal.com/

agentic future.

I research emerging threats and build open-source defenses for AI agents, the software they write, and the tools they trust.

Software engineer, security researcher, and open-source maintainer.
Leading Developer Relations at [Snyk](https://snyk.io/).

[Explore my research](/research)[Read the blog](/writing)

[Hire me](/hire-me) /[Invite me to speak](/speaking) /[Bio & press kit](/speaking/press-kit)

 ![Liran Tal](/_astro/liran-tal-portrait-cutout.CMaXTtwJ_Zhsv27.webp)

*   [Awarded GitHub Star (alumni)](https://stars.github.com/alumni) [#4 GitHub Trending · 2025](/recognitions#milestones-heading)
*   [Awarded OpenJS Security Pathfinder](/recognitions)
*   |[All recognitions](/recognitions)

My work spans AI agents, developer tooling, and software supply chain security: co-authored papers, vulnerability disclosures, patents, and research that became practical defenses.

October 2026 · arXiv preprint

### [How Deterministic SAST and AI Security Agents Divide the Work: Coverage, Harness Policy and Cost in Snyk VulnBench 2.0](https://arxiv.org/abs/2610.38617)

An evaluation of deterministic SAST and AI security agents on 108 vulnerabilities across 20 open-source applications, examining coverage, harness policy, and cost. Snyk Code and Claude Code’s strongest evaluated configuration together covered 101 of 108 vulnerabilities.

Liran Tal, Chris Liu, Charlotte Fereday, Sebastian Roth, and Brian Clark

[Read PDF](https://arxiv.org/pdf/2610.38617) [DOI](https://doi.org/10.48550/arXiv.2610.38617)

October 2026 · arXiv preprint

### [VulnBump: A Benchmark for Fixing Vulnerable Dependencies in Real Projects While Keeping the Build and Tests Green](https://arxiv.org/abs/2610.17374)

A benchmark of 307 dependency upgrades across 43 repositories, evaluating whether AI agents fix vulnerabilities while preserving successful builds and tests.

Gabija Pasiunaite, Ryan McMorrow, Brian Clark, Liran Tal, and Luke Tu

[Read PDF](https://arxiv.org/pdf/2610.17374) [DOI](https://doi.org/10.48550/arXiv.2610.17374)

[All papers](/research/papers)[Reports & chapters](/research/reports)[CVEs & advisories](/research/advisories)[Lockfile injection research](/research/lockfile-injection)

Lint lockfiles for trusted registries and protect against lockfile injection.

Check package health and security signals before installing npm dependencies.

A practical guide to building thoughtful, accessible, and reliable command-line applications.

 [![](/_astro/self-host-hermes-agent-matrix-e2ee-proxmox.D6XUPjt5_Ua06g.png)

Sep 5, 2026

### Self-Hosting Hermes Agent with Matrix E2EE on Proxmox

Build a private, mobile-first Hermes Agent using Matrix Synapse, Element, end-to-end encryption, Tailscale Serve, and separate Proxmox LXC containers.](/blog/self-host-hermes-agent-matrix-e2ee-proxmox)

 [![](/_astro/practical-second-brain-llm-markdown-knowledge-graph.CEcxBkpJ_Z19xT21.png)

Aug 2, 2026

### The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph

A hands-on guide to the files, schemas, workflows, governance, and maintenance routines behind an AI-assisted second brain.](/blog/practical-second-brain-llm-markdown-knowledge-graph)

 [![](/_astro/building-second-brain-llms-ai-agents.B3w2y6mA_2fR1l0.png)

Aug 1, 2026

### Building a Second Brain with LLMs and AI Agents

How a plain-Markdown knowledge graph becomes a durable context layer, operating system, and compounding productivity tool for AI-assisted work.](/blog/building-second-brain-llms-ai-agents)

### Liran’s writing on the web

#### [Node.js Security](https://www.nodejs-security.com/blog)

Vulnerability deep dives and practical secure coding for JavaScript developers.

#### [Snyk](https://snyk.io/contributors/liran-tal/)

Articles and research on AI security, application security, and the software supply chain.

![Liran Tal presenting at JSNation US 2025](/_astro/speaking-hero.DpA-4YgT_Z1VB4Gd.webp)

### 225 talks.
21 countries.

Plenty of live hacking. I bring real-world attacks and practical defenses to conferences, meetups, and workshops. AI security, Node.js, and the software supply chain, explained through code.

[Watch a talk](/speaking/recordings)[Speaker press kit](/speaking/press-kit)[Invite me to speak](/speaking)

npm downloads

4.27M

5 selected maintained packages

GitHub stars

13,975

6 featured repositories

GitHub contributions

[7,331](https://github.com/lirantal?tab=overview&from=2026-01-01&to=2026-11-01)

2026 · as of Nov 1, 2026

### npm downloads monthly, 2026

*   [lockfile-lint](https://www.npmjs.com/package/lockfile-lint) 1,639,784
*   [lockfile-lint-api](https://www.npmjs.com/package/lockfile-lint-api) 1,738,224
*   [blessed-contrib](https://www.npmjs.com/package/blessed-contrib) 611,306
*   [anti-trojan-source](https://www.npmjs.com/package/anti-trojan-source) 156,491
*   [eslint-plugin-anti-trojan-source](https://www.npmjs.com/package/eslint-plugin-anti-trojan-source) 125,132

Sep 17, 2026–Oct 16, 2026. Includes dependency installs.

Download data sources

*   [lockfile-lint download record](https://api.npmjs.org/downloads/point/2026-09-17:2026-10-16/lockfile-lint)
*   [lockfile-lint-api download record](https://api.npmjs.org/downloads/point/2026-09-17:2026-10-16/lockfile-lint-api)
*   [blessed-contrib download record](https://api.npmjs.org/downloads/point/2026-09-17:2026-10-16/blessed-contrib)
*   [anti-trojan-source download record](https://api.npmjs.org/downloads/point/2026-09-17:2026-10-16/anti-trojan-source)
*   [eslint-plugin-anti-trojan-source download record](https://api.npmjs.org/downloads/point/2026-09-17:2026-10-16/eslint-plugin-anti-trojan-source)

[Browse all my npm packages](https://www.npmjs.com/~lirantal)

### GitHub stars & forks snapshot, 2026

*   [lockfile-lint](https://github.com/lirantal/lockfile-lint) 870 stars · 37 forks
*   [npq](https://github.com/lirantal/npq) 1,794 stars · 44 forks
*   [dockly](https://github.com/lirantal/dockly) 4,035 stars · 170 forks
*   [anti-trojan-source](https://github.com/lirantal/anti-trojan-source) 90 stars · 12 forks
*   [nodejs-cli-apps-best-practices](https://github.com/lirantal/nodejs-cli-apps-best-practices) 4,137 stars · 171 forks
*   [awesome-nodejs-security](https://github.com/lirantal/awesome-nodejs-security) 3,049 stars · 329 forks

As of Oct 20, 2026.

### [Node.js contributions](/open-source/contributions#nodejs-core)

*   A merged fix for child\_process prototype-pollution hardening.
*   [Member of the Node.js Foundation’s Ecosystem Security Working Group (2018).](/open-source/contributions#security-wg)

### [OWASP leadership & guidance](/open-source/contributions#owasp)

*   Co-authored npm security practices that became the basis of an OWASP cheat sheet.
*   [Co-lead of the OWASP NodeGoat project.](/open-source/contributions#owasp)

### [JavaScript & PHP rankings in Israel](/open-source/impact#languages)

#1 for JavaScript and #1 for PHP on GitRanks. Profile updated November 4, 2026.

[Ecosystem contributions](/open-source/contributions)[Impact & rankings](/open-source/impact)

Practical guides built around real vulnerabilities, with code to break, fixes to understand, and techniques to take back to your own projects.

 [![Mitigate and Weaponize Code Injection Vulnerabilities](/_astro/code-injection-book-cover-light.20WkHquX_bRguL.webp) Node.js Secure Coding

### Mitigate and Weaponize Code Injection Vulnerabilities](https://www.nodejs-security.com/book/code-injection)

 [![Defending Against Command Injection](/_astro/command-injection-book-cover-light.C1ZZ6boX_WuaXp.webp) Node.js Secure Coding

### Defending Against Command Injection](https://www.nodejs-security.com/book/command-injection)

 [![Prevention and Exploitation of Path Traversal](/_astro/path-traversal-book-cover-light.DEVGRR-C_Z2kuuyk.webp) Node.js Secure Coding

### Prevention and Exploitation of Path Traversal](https://www.nodejs-security.com/book/path-traversal)

 [![Web Security: Learning HTTP Security Headers](/_astro/book-cover-web-security-learning-http-security-headers.gAYMWHgV_ZqUlQN.webp)](https://nodejs-security.lemonsqueezy.com/checkout/buy/3e91088f-cbb8-41a0-9c3a-5d60233f6f7b "Web Security: Learning HTTP Security Headers")[![Serverless Security](/_astro/book-cover-serverless-security.sKKJKNQV_be8Nq.webp) ](https://www.oreilly.com/library/view/serverless-security/9781492082538/ "Serverless Security")[![Essential Node.js Security](/_astro/book-cover-essential-nodejs-security.fC6wm2WB_Z1tX9uY.webp) ](https://nodejs-security.lemonsqueezy.com/checkout/buy/5d5975e1-4481-40a5-b180-de154cc865b0 "Essential Node.js Security")[![Bun Security Essentials](/_astro/bun-security-essentials-book-frontcover.CzbDO5p7_Z1imX6U.webp)](https://bunsecurity.dev "Bun Security Essentials")

Dark Reading

Mar 18, 2022

Expert commentary · English

### [Code-Sabotage Incident in Protest of Ukraine War Exposed Open Source Risks](https://www.darkreading.com/application-security/recent-code-sabotage-incident-latest-to-highlight-code-dependency-risks)

Comments to Dark Reading and quotations from my research on node-ipc sabotage and the risks of transitive dependencies.

TheMarker

Mar 20, 2025

Quoted & mentioned · Hebrew

### [A young entrepreneur let AI code for him. Hackers had a field day on his website](https://www.themarker.com/captain-internet/2025-03-20/ty-article/.premium/00000195-b30c-de74-add7-bb1fba850000)

Ran Bar-Zik quotes and mentions me in his reporting on AI-assisted coding and the security risks facing inexperienced developers.

Geektime

Mar 20, 2022

Research featured · Hebrew

### [Israeli researcher uncovers malicious code in a popular open-source package](https://www.geektime.co.il/a-developer-left-a-nasty-surprise-in-popular-npm-package/)

Coverage of my node-ipc investigation, including its destructive behavior and the implications for software supply chain security.

The New Stack

Oct 30, 2026

Talk featured · English

### [Kubernetes just formed a workload conformance group. Here’s why it matters for AI teams.](https://thenewstack.io/kubernetes-workload-conformance-ai/)

Bill Doerrfeld highlights my AGNTCon + MCPCon talk on malicious agent skills and practical defenses against agents installing malware.

HPE sponsored this article.

From the community

## Better together.

![](/images/blog/manicode.jpg)

> “Some people talk about AppSec (me) and some people really dig in and do the work (you). I’m a big fan.”

— by Jim Manico, OWASP Leader · [Original post](https://twitter.com/manicode/status/1326929685553451008)

![](/images/blog/loige.jpg)

> “FANTASTIC WORKSHOP! Learned a ton! Thanks a lot 🙏”

— by Luciano Mammino, Author of Node.js Design Patterns · [Original post](https://twitter.com/loige/status/1576984806092525570)

![](/images/blog/cryptus_neoxys.jpg)

> “This has become my primary source for learning docker with node. Thanks for sharing these 💝”

— by Dev Sharma, Software Developer · [Original post](https://twitter.com/cryptus_neoxys/status/1393221416175034369)

![](/images/blog/jjperezaguinaga.jpg)

> “This is one of the best guides I’ve seen on this topic, really cool stuff.”

— by Jose Aguinaga, Head of Engineering at HOPR · [Original post](https://twitter.com/jjperezaguinaga/status/1349368415014825989)

[More community feedback & recognitions](/recognitions)

```json
{"@context":"https://schema.org","@type":"Person","name":"Liran Tal","url":"https://lirantal.com","description":"AI security researcher, open-source maintainer, and author. Explore Liran Tal’s blog, research papers, developer tools, books, and conference talks.","jobTitle":"Software engineer, security researcher, and open-source maintainer","sameAs":["https://github.com/lirantal","https://www.linkedin.com/in/talliran","https://twitter.com/liran_tal","https://infosec.exchange/@lirantal"]}
```