Supply chain security
lockfile-lint
Lint lockfiles for trusted registries and protect against lockfile injection.
Security researcher Author Open-source maintainer
Securing the agentic future.
I research emerging threats and build open-source defenses for AI agents, the software they write, and the tools they trust.
I head Developer Relations at Snyk
- Awarded GitHub Star
- Awarded OpenJS Security Pathfinder
Tools & resources I maintain
More projects & impactDeveloper tooling
npq
Check package health and security signals before installing npm dependencies.
Community guide
Node.js CLI Apps Best Practices
A practical guide to building thoughtful, accessible, and reliable command-line applications.
01 / Speaking
From the terminal to the stage.
223 talks. 21 countries.
Plenty of live hacking.
I bring real-world attacks and practical defenses to conferences, meetups, and workshops. AI security, Node.js, and the software supply chain, explained through code.
02 / Blog & articles
What I’m learning. What I’m sharing.
On the blog ·
Self-Hosting Hermes Agent with Matrix E2EE on Proxmox
Build a private, mobile-first Hermes Agent using Matrix Synapse, Element, end-to-end encryption, Tailscale Serve, and separate Proxmox LXC containers.
On the blog ·
The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph
A hands-on guide to the files, schemas, workflows, governance, and maintenance routines behind an AI-assisted second brain.
On the blog ·
Building a Second Brain with LLMs and AI Agents
How a plain-Markdown knowledge graph becomes a durable context layer, operating system, and compounding productivity tool for AI-assisted work.
03 / Research
Investigating how systems fail.
My work spans AI agents, developer tooling, and software supply chain security: co-authored papers, vulnerability disclosures, patents, and research that became practical defenses.
October 2026
arXiv · Preprint
VulnBump: A Benchmark for Fixing Vulnerable Dependencies in Real Projects While Keeping the Build and Tests Green
A benchmark of 307 dependency upgrades across 43 repositories, evaluating whether AI agents fix vulnerabilities while preserving successful builds and tests.
Gabija Pasiunaite, Ryan McMorrow, Brian Clark, Liran Tal, and Luke Tu
June 2026
arXiv · Preprint
Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?
Repeated vulnerability scans on JavaScript code explore the consistency of LLM security review and how it complements deterministic static analysis.
Liran Tal, Johannes Kloos, Arsenii Rudich, Stephen Thoemmes, and Manoj Nair
04 / Open source
Useful tools. Shared with everyone.
- npm downloads
- 4.27M
- GitHub stars
- 13,975
- GitHub forks
- 763
5 selected maintained packages
6 featured repositories
6 featured repositories
Sep 17, 2026 – Oct 16, 2026. Package downloads, not unique developers; totals include dependency installs.
Packages & source counts
- lockfile-lint 1,639,784
- lockfile-lint-api 1,738,224
- blessed-contrib 611,306
- anti-trojan-source 156,491
- eslint-plugin-anti-trojan-source 125,132
GitHub snapshot: Oct 20, 2026. Stars and forks across the six featured repositories, not unique people or all my projects.
Repositories & source counts
- lockfile-lint 870 stars · 37 forks
- npq 1,794 stars · 44 forks
- dockly 4,035 stars · 170 forks
- anti-trojan-source 90 stars · 12 forks
- nodejs-cli-apps-best-practices 4,137 stars · 171 forks
- awesome-nodejs-security 3,049 stars · 329 forks
Supply chain security
lockfile-lint
Lint lockfiles for trusted registries and protect against lockfile injection.
Developer tooling
npq
Check package health and security signals before installing npm dependencies.
Developer tooling
dockly
An interactive terminal interface for managing Docker containers and services.
Code security
anti-trojan-source
Detect bidirectional Unicode characters used to disguise malicious source code.
Community guide
Node.js CLI Apps Best Practices
A practical guide to building thoughtful, accessible, and reliable command-line applications.
Curated resources
Awesome Node.js Security
Security resources, tools, and learning material for the Node.js ecosystem.
05 / Books
A bookshelf for more secure code.
Practical guides built around real vulnerabilities, with code to break, fixes to understand, and techniques to take back to your own projects.
Node.js Secure Coding
Mitigate and Weaponize Code Injection Vulnerabilities
Node.js Secure Coding
Defending Against Command Injection
Node.js Secure Coding
Prevention and Exploitation of Path Traversal
Practical web security
Web Security: Learning HTTP Security Headers
Co-author · O’Reilly
Serverless Security
From the community
Better together.
“Some people talk about AppSec (me) and some people really dig in and do the work (you). I’m a big fan.”
“FANTASTIC WORKSHOP! Learned a ton! Thanks a lot 🙏”
“This has become my primary source for learning docker with node. Thanks for sharing these 💝”
“This is one of the best guides I’ve seen on this topic, really cool stuff.”