--- title: "Liran Tal — AI Security Research & Node.js Security" description: "AI security researcher, open-source maintainer, and author. Explore Liran Tal’s blog, research papers, developer tools, books, and conference talks." canonical: "https://lirantal.com/" --- # Liran Tal — AI Security Research & Node.js Security · Security researcher · Author · Open-source maintainer # Hi, I’m Liran Tal. I help developers build secure software, from Node.js to AI agents. I research, write, and build tools in the open. I head Developer Relations at [Snyk](https://snyk.io/contributors/liran-tal/) [Read my blog →](/writing) [Invite me to speak →](/speaking) [Bio & press kit →](/speaking/press-kit) * Awarded [GitHub Star](https://stars.github.com/alumni) * Awarded [OpenJS Security Pathfinder](/recognitions) ![Liran Tal](/_astro/liran-tal-portrait.E8dSLkyf_1HmSE9.webp) [](https://twitter.com/liran_tal "X / Twitter")[](https://github.com/lirantal "GitHub")[](https://www.linkedin.com/in/talliran "LinkedIn") ## Tools & resources I maintain [More projects & impact →](#open-source) Supply chain security ### [lockfile-lint ↗](https://github.com/lirantal/lockfile-lint) Lint lockfiles for trusted registries and protect against lockfile injection. Developer tooling ### [npq ↗](https://github.com/lirantal/npq) Check package health and security signals before installing npm dependencies. Community guide ### [Node.js CLI Apps Best Practices ↗](https://github.com/lirantal/nodejs-cli-apps-best-practices) A practical guide to building thoughtful, accessible, and reliable command-line applications. ## 01 / Speaking From the terminal to the stage. [Explore talks & events →](/speaking) ![Liran Tal presenting at JSNation US 2025](/_astro/speaking-hero.DpA-4YgT_Z1VB4Gd.webp) 223 talks. 21 countries. Plenty of live hacking. I bring real-world attacks and practical defenses to conferences, meetups, and workshops. AI security, Node.js, and the software supply chain, explained through code. [Watch a talk →](/speaking/recordings)[Speaker press kit →](/speaking/press-kit) ## 02 / Blog & articles What I’m learning. What I’m sharing. [Blog & publications →](/writing) On the blog · Sep 5, 2026 ### [Self-Hosting Hermes Agent with Matrix E2EE on Proxmox](/blog/self-host-hermes-agent-matrix-e2ee-proxmox) Build a private, mobile-first Hermes Agent using Matrix Synapse, Element, end-to-end encryption, Tailscale Serve, and separate Proxmox LXC containers. On the blog · Aug 2, 2026 ### [The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph](/blog/practical-second-brain-llm-markdown-knowledge-graph) A hands-on guide to the files, schemas, workflows, governance, and maintenance routines behind an AI-assisted second brain. On the blog · Aug 1, 2026 ### [Building a Second Brain with LLMs and AI Agents](/blog/building-second-brain-llms-ai-agents) How a plain-Markdown knowledge graph becomes a durable context layer, operating system, and compounding productivity tool for AI-assisted work. Beyond this blog ### [Node.js Security ↗](https://www.nodejs-security.com/blog) Vulnerability deep dives and practical secure coding for JavaScript developers. ### [Snyk ↗](https://snyk.io/contributors/liran-tal/) Articles and research on AI security, application security, and the software supply chain. [Follow this blog via RSS →](/rss.xml) ## 03 / Research Investigating how systems fail. My research focuses on AI agents, developer tooling, and software supply chain security. These are selected co-authored papers, available as preprints on arXiv. June 2026 arXiv · Preprint ### [Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice? ↗](https://arxiv.org/abs/2606.15762) Repeated vulnerability scans on JavaScript code explore the consistency of LLM security review and how it complements deterministic static analysis. Liran Tal, Johannes Kloos, Arsenii Rudich, Stephen Thoemmes, and Manoj Nair [Read PDF](https://arxiv.org/pdf/2606.15762) · [DOI: 10.48550/arXiv.2606.15762](https://doi.org/10.48550/arXiv.2606.15762) May 2026 arXiv · Preprint ### [Technical Report: Exploring the Emerging Threats of the Agent Skill Ecosystem ↗](https://arxiv.org/abs/2605.28588) An analysis of 3,984 agent skills, documenting malicious payloads, credential theft, and the security risks of emerging skill marketplaces. Luca Beurer-Kellner, Aleksei Kudrinskii, Marco Milanta, Kristian Bonde Nielsen, Hemang Sarkar, and Liran Tal [Read PDF](https://arxiv.org/pdf/2605.28588) · [DOI: 10.48550/arXiv.2605.28588](https://doi.org/10.48550/arXiv.2605.28588) ## 04 / Open source Useful tools. Shared with everyone. [All projects on GitHub ↗](https://github.com/lirantal) 4.27M downloads across 5 maintained npm packages Sep 17, 2026 – Oct 16, 2026. Package downloads, not unique developers; totals include dependency installs. Packages & source counts + − * [lockfile-lint](https://api.npmjs.org/downloads/point/2026-09-17:2026-10-16/lockfile-lint) 1,639,784 * [lockfile-lint-api](https://api.npmjs.org/downloads/point/2026-09-17:2026-10-16/lockfile-lint-api) 1,738,224 * [blessed-contrib](https://api.npmjs.org/downloads/point/2026-09-17:2026-10-16/blessed-contrib) 611,306 * [anti-trojan-source](https://api.npmjs.org/downloads/point/2026-09-17:2026-10-16/anti-trojan-source) 156,491 * [eslint-plugin-anti-trojan-source](https://api.npmjs.org/downloads/point/2026-09-17:2026-10-16/eslint-plugin-anti-trojan-source) 125,132 [Browse all my npm packages↗](https://www.npmjs.com/~lirantal) Supply chain security ### [lockfile-lint ↗](https://github.com/lirantal/lockfile-lint) Lint lockfiles for trusted registries and protect against lockfile injection. Developer tooling ### [npq ↗](https://github.com/lirantal/npq) Check package health and security signals before installing npm dependencies. Developer tooling ### [dockly ↗](https://github.com/lirantal/dockly) An interactive terminal interface for managing Docker containers and services. Code security ### [anti-trojan-source ↗](https://github.com/lirantal/anti-trojan-source) Detect bidirectional Unicode characters used to disguise malicious source code. Community guide ### [Node.js CLI Apps Best Practices ↗](https://github.com/lirantal/nodejs-cli-apps-best-practices) A practical guide to building thoughtful, accessible, and reliable command-line applications. Curated resources ### [Awesome Node.js Security ↗](https://github.com/lirantal/awesome-nodejs-security) Security resources, tools, and learning material for the Node.js ecosystem. ## 05 / Books A bookshelf for more secure code. [Explore Node.js Secure Coding →](/books/nodejs-secure-coding) Practical guides built around real vulnerabilities, with code to break, fixes to understand, and techniques to take back to your own projects. [![](/_astro/code-injection-book-cover-light.20WkHquX_bRguL.webp)](https://www.nodejs-security.com/book/code-injection) Node.js Secure Coding ### [Mitigate and Weaponize Code Injection Vulnerabilities ↗](https://www.nodejs-security.com/book/code-injection) [![](/_astro/command-injection-book-cover-light.C1ZZ6boX_WuaXp.webp)](https://www.nodejs-security.com/book/command-injection) Node.js Secure Coding ### [Defending Against Command Injection ↗](https://www.nodejs-security.com/book/command-injection) [![](/_astro/path-traversal-book-cover-light.DEVGRR-C_Z2kuuyk.webp)](https://www.nodejs-security.com/book/path-traversal) Node.js Secure Coding ### [Prevention and Exploitation of Path Traversal ↗](https://www.nodejs-security.com/book/path-traversal) [![](/_astro/book-cover-web-security-learning-http-security-headers.gAYMWHgV_ZqUlQN.webp)](https://nodejs-security.lemonsqueezy.com/checkout/buy/3e91088f-cbb8-41a0-9c3a-5d60233f6f7b) Practical web security ### [Web Security: Learning HTTP Security Headers ↗](https://nodejs-security.lemonsqueezy.com/checkout/buy/3e91088f-cbb8-41a0-9c3a-5d60233f6f7b) [![](/_astro/book-cover-serverless-security.sKKJKNQV_be8Nq.webp)](https://www.oreilly.com/library/view/serverless-security/9781492082538/) Co-author · O’Reilly ### [Serverless Security ↗](https://www.oreilly.com/library/view/serverless-security/9781492082538/) From the community ## Better together. > “Some people talk about AppSec (me) and some people really dig in and do the work (you). I’m a big fan.” Jim Manico · OWASP Leader · [Original post ↗](https://twitter.com/manicode/status/1326929685553451008) [More community feedback & recognitions →](/recognitions) ```json {"@context":"https://schema.org","@type":"Person","name":"Liran Tal","url":"https://lirantal.com","description":"AI security researcher, open-source maintainer, and author. Explore Liran Tal’s blog, research papers, developer tools, books, and conference talks.","jobTitle":"AI security researcher, open-source maintainer, and author","sameAs":["https://github.com/lirantal","https://www.linkedin.com/in/talliran","https://twitter.com/liran_tal","https://infosec.exchange/@lirantal"]} ```