Supply chain security
lockfile-lint
Lint lockfiles for trusted registries and protect against lockfile injection.
Security researcher Author Open-source maintainer
Hi, I’m Liran Tal.
I help developers build secure software,
from Node.js to
AI agents. I research, write, and build tools in
the open.
I head Developer Relations at Snyk
- Awarded GitHub Star
- Awarded OpenJS Security Pathfinder
Tools & resources I maintain
More projects & impactDeveloper tooling
npq
Check package health and security signals before installing npm dependencies.
Community guide
Node.js CLI Apps Best Practices
A practical guide to building thoughtful, accessible, and reliable command-line applications.
01 / Speaking
From the terminal to the stage.
223 talks. 21 countries.
Plenty of live hacking.
I bring real-world attacks and practical defenses to conferences, meetups, and workshops. AI security, Node.js, and the software supply chain, explained through code.
02 / Blog & articles
What I’m learning. What I’m sharing.
On the blog ·
Self-Hosting Hermes Agent with Matrix E2EE on Proxmox
Build a private, mobile-first Hermes Agent using Matrix Synapse, Element, end-to-end encryption, Tailscale Serve, and separate Proxmox LXC containers.
On the blog ·
The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph
A hands-on guide to the files, schemas, workflows, governance, and maintenance routines behind an AI-assisted second brain.
On the blog ·
Building a Second Brain with LLMs and AI Agents
How a plain-Markdown knowledge graph becomes a durable context layer, operating system, and compounding productivity tool for AI-assisted work.
03 / Research
Investigating how systems fail.
My research focuses on AI agents, developer tooling, and software supply chain security. These are selected co-authored papers, available as preprints on arXiv.
June 2026
arXiv · Preprint
Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?
Repeated vulnerability scans on JavaScript code explore the consistency of LLM security review and how it complements deterministic static analysis.
Liran Tal, Johannes Kloos, Arsenii Rudich, Stephen Thoemmes, and Manoj Nair
May 2026
arXiv · Preprint
Technical Report: Exploring the Emerging Threats of the Agent Skill Ecosystem
An analysis of 3,984 agent skills, documenting malicious payloads, credential theft, and the security risks of emerging skill marketplaces.
Luca Beurer-Kellner, Aleksei Kudrinskii, Marco Milanta, Kristian Bonde Nielsen, Hemang Sarkar, and Liran Tal
04 / Open source
Useful tools. Shared with everyone.
4.27M
downloads across 5 maintained npm packages
Sep 17, 2026 – Oct 16, 2026. Package downloads, not unique developers; totals include dependency installs.
Packages & source counts
- lockfile-lint 1,639,784
- lockfile-lint-api 1,738,224
- blessed-contrib 611,306
- anti-trojan-source 156,491
- eslint-plugin-anti-trojan-source 125,132
Supply chain security
lockfile-lint
Lint lockfiles for trusted registries and protect against lockfile injection.
Developer tooling
npq
Check package health and security signals before installing npm dependencies.
Developer tooling
dockly
An interactive terminal interface for managing Docker containers and services.
Code security
anti-trojan-source
Detect bidirectional Unicode characters used to disguise malicious source code.
Community guide
Node.js CLI Apps Best Practices
A practical guide to building thoughtful, accessible, and reliable command-line applications.
Curated resources
Awesome Node.js Security
Security resources, tools, and learning material for the Node.js ecosystem.
05 / Books
A bookshelf for more secure code.
Practical guides built around real vulnerabilities, with code to break, fixes to understand, and techniques to take back to your own projects.
Node.js Secure Coding
Mitigate and Weaponize Code Injection Vulnerabilities
Node.js Secure Coding
Defending Against Command Injection
Node.js Secure Coding
Prevention and Exploitation of Path Traversal
Practical web security
Web Security: Learning HTTP Security Headers
Co-author · O’Reilly
Serverless Security
From the community
Better together.
“Some people talk about AppSec (me) and some people really dig in and do the work (you). I’m a big fan.”