Reporting on my research, conversations about my work, and references from the developer community.
Reporting on my research and commentary on software security.
The New Stack
Talk featured · English
Bill Doerrfeld highlights my AGNTCon + MCPCon talk on malicious agent skills and practical defenses against agents installing malware.
HPE sponsored this article.
TheMarker
Quoted & mentioned · Hebrew
יזם צעיר נתן ל-AI לתכנת במקומו. האקרים חגגו על האתר שלו
Ran Bar-Zik quotes and mentions me in his reporting on AI-assisted coding and the security risks facing inexperienced developers.
Dark Reading
Expert commentary · English
Comments to Dark Reading and quotations from my research on node-ipc sabotage and the risks of transitive dependencies.
Geektime
Research featured · Hebrew
ישראלי גילה חבילת קוד פתוח פופולרית עם הפתעה לא נעימה למפתחים ברוסיה
Coverage of my node-ipc investigation, including its destructive behavior and the implications for software supply chain security.
Computing
Research quoted · English
Quotes my published analysis of the node-ipc supply chain incident and the trust placed in open-source maintainers.
Conversations about security, developer advocacy, and open source.
SiliconANGLE / theCUBE
Video interview · English
A conversation with Lisa Martin about developer security, shift-left practices, and integrating security into development workflows.
Snyk sponsored this theCUBE segment; the publisher states sponsors had no editorial control.
Developer Avocados
Written interview · English
A discussion of developer advocacy, security education, community, and the path from engineering into Developer Relations.
SurviveJS
Written interview · English
An interview with Juho Vepsäläinen about secure coding, developer education, and security tooling.
Free Software Magazine
Written interview · English
An interview with Tony Mobily about creating daloRADIUS, its early development, and the open-source community supporting it.
Tools, analysis, and guidance referenced by the developer community.
Safeguard
Research cited · English
Safeguard’s research team discusses our co-authored Snyk VulnBench JS 1.0 benchmark on the repeatability of LLM vulnerability scanning and mentions me by name.
CramHacks
Guidance cited · English
Kyle Kelly cites my npm ignore-scripts guidance when discussing lifecycle-script risks and defenses against software supply chain attacks.
Internet Israel
Tool & talk recommended · Hebrew
מידע על אבטחה שכל מפתח צד לקוח צריך להכיר
Recommends my npq tool and includes my talk on AI and secure code among further learning resources.
Internet Israel
Information & screenshot credited · Hebrew
מפתח הכניס באג מכוון בחבילת ה-npm הפופולרית שלו
Credits me for the initial information and a screenshot used in coverage of the colors/faker incident.
Tao Bojlén
Tool cited · English
Cites my npq tool as an example of checking packages before installation while exploring trust relationships among npm maintainers.
Internet Israel
Analysis cited · Hebrew
npm-shrinkwrap ככלי לנעילת גרסאות
References my analysis of the is-promise incident to explain why dependency version pinning matters.
OSTechNix
Tool featured · English
Senthilkumar Palani (SK) walks through installing and using npq to inspect npm packages before handing installation over to npm or Yarn.
Internet Israel
Tool featured · Hebrew
מודול לבדיקת אבטחה של ספריות צד לקוח של אתר
A walkthrough of my is-website-vulnerable command-line tool for identifying vulnerable JavaScript libraries on websites.
Internet Israel
Security guidance credited · Hebrew
אל תשתמשו ב-child_process.exec כדי להריץ פקודות ב-node שלכם
Credits my review for flagging a potential security issue in branch-lint and motivating safer command execution practices.
Thomas Gentilhomme
Tool referenced in book · French
My npq tool is referenced in Thomas Gentilhomme’s French-language Node.js book, as recorded in the project’s media coverage references.
For articles I authored, explore writing published elsewhere. Reports and chapters are collected under Research.