# Liran Tal — Media & interviews

Selected media coverage, interviews, and references to Liran Tal’s security research and open-source work, including Dark Reading, Geektime, and Computing.

Canonical: https://lirantal.com/media

## In the news

Reporting on my research and commentary on software security.

The New Stack

Oct 30, 2026

Talk featured · English

### [Kubernetes just formed a workload conformance group. Here’s why it matters for AI teams.](https://thenewstack.io/kubernetes-workload-conformance-ai/)

Bill Doerrfeld highlights my AGNTCon + MCPCon talk on malicious agent skills and practical defenses against agents installing malware.

HPE sponsored this article.

TheMarker

Mar 20, 2025

Quoted & mentioned · Hebrew

### [A young entrepreneur let AI code for him. Hackers had a field day on his website](https://www.themarker.com/captain-internet/2025-03-20/ty-article/.premium/00000195-b30c-de74-add7-bb1fba850000)

יזם צעיר נתן ל-AI לתכנת במקומו. האקרים חגגו על האתר שלו

Ran Bar-Zik quotes and mentions me in his reporting on AI-assisted coding and the security risks facing inexperienced developers.

Dark Reading

Mar 18, 2022

Expert commentary · English

### [Code-Sabotage Incident in Protest of Ukraine War Exposed Open Source Risks](https://www.darkreading.com/application-security/recent-code-sabotage-incident-latest-to-highlight-code-dependency-risks)

Comments to Dark Reading and quotations from my research on node-ipc sabotage and the risks of transitive dependencies.

Geektime

Mar 20, 2022

Research featured · Hebrew

### [Israeli researcher uncovers malicious code in a popular open-source package](https://www.geektime.co.il/a-developer-left-a-nasty-surprise-in-popular-npm-package/)

ישראלי גילה חבילת קוד פתוח פופולרית עם הפתעה לא נעימה למפתחים ברוסיה

Coverage of my node-ipc investigation, including its destructive behavior and the implications for software supply chain security.

Computing

Research quoted · English

### [Open source dev sabotages own library to target Russian and Belarusian users](https://www.computing.co.uk/news/4046716/open-source-dev-sabotages-library-target-russian-belarusian-users)

Quotes my published analysis of the node-ipc supply chain incident and the trust placed in open-source maintainers.

## Interviews

Conversations about security, developer advocacy, and open source.

SiliconANGLE / theCUBE

Jan 17, 2022

Video interview · English

### [How Snyk’s approach to application security remedies shift-left shortcomings](https://siliconangle.com/2022/01/17/snyks-approach-application-security-remedies-shift-left-shortcomings-awsshowcases2e1/)

A conversation with Lisa Martin about developer security, shift-left practices, and integrating security into development workflows.

Snyk sponsored this theCUBE segment; the publisher states sponsors had no editorial control.

Developer Avocados

Dec 12, 2021

Written interview · English

### [Liran Tal — Adventcado 2021](https://avocados.dev/adventcado/2021/12/12/liran-tal/)

A discussion of developer advocacy, security education, community, and the path from engineering into Developer Relations.

SurviveJS

Jul 31, 2019

Written interview · English

### [Secure Coding — Interview with Liran Tal](https://survivejs.com/blog/secure-coding-interview/)

An interview with Juho Vepsäläinen about secure coding, developer education, and security tooling.

Free Software Magazine

Jun 23, 2008

Written interview · English

### [Interview with Liran Tal, author of daloRADIUS](https://freesoftwaremagazine.com/articles/interview_liran_tal_author_daloradius/)

An interview with Tony Mobily about creating daloRADIUS, its early development, and the open-source community supporting it.

## Work cited & featured

Tools, analysis, and guidance referenced by the developer community.

Safeguard

Jul 7, 2026

Research cited · English

### [Can an LLM find the same bug twice? What repeatability benchmarking reveals](https://safeguard.sh/resources/blog/llm-code-review-repeatability-vulnerability-benchmarking)

Safeguard’s research team discusses our co-authored Snyk VulnBench JS 1.0 benchmark on the repeatability of LLM vulnerability scanning and mentions me by name.

CramHacks

Feb 27, 2025

Guidance cited · English

### [Lessons Learned from 2024's Supply Chain Attacks](https://www.cramhacks.com/p/lessons-learned-from-2024-s-supply-chain-attacks)

Kyle Kelly cites my npm ignore-scripts guidance when discussing lifecycle-script risks and defenses against software supply chain attacks.

Internet Israel

Nov 10, 2024

Tool & talk recommended · Hebrew

### [Security information every frontend developer should know](https://internet-israel.com/פיתוח-אינטרנט/בניית-אתרי-אינטרנט-למפתחים/מידע-על-אבטחה-שכל-מפתח-צד-לקוח-צריך-להכי/)

מידע על אבטחה שכל מפתח צד לקוח צריך להכיר

Recommends my npq tool and includes my talk on AI and secure code among further learning resources.

Internet Israel

Jan 9, 2022

Information & screenshot credited · Hebrew

### [A developer deliberately sabotaged his popular npm package](https://internet-israel.com/חדשות-אינטרנט/מפתח-הכניס-באג-מכוון-בחבילת-ה-npm-הפופולר/)

מפתח הכניס באג מכוון בחבילת ה-npm הפופולרית שלו

Credits me for the initial information and a screenshot used in coverage of the colors/faker incident.

Tao Bojlén

Oct 2, 2020

Tool cited · English

### [A web of trust for npm](https://btao.org/posts/2020-10-02-npm-trust/)

Cites my npq tool as an example of checking packages before installation while exploring trust relationships among npm maintainers.

Internet Israel

May 17, 2020

Analysis cited · Hebrew

### [npm-shrinkwrap for version pinning](https://internet-israel.com/מדריכים/node-js-מדריכים/npm-shrinkwrap-ככלי-לנעילת-גרסאות/)

npm-shrinkwrap ככלי לנעילת גרסאות

References my analysis of the is-promise incident to explain why dependency version pinning matters.

OSTechNix

Dec 20, 2019

Tool featured · English

### [How To Safely Install Packages Using Npm Or Yarn On Linux](https://ostechnix.com/how-to-safely-install-packages-using-npm-or-yarn-on-linux/)

Senthilkumar Palani (SK) walks through installing and using npq to inspect npm packages before handing installation over to npm or Yarn.

Internet Israel

Nov 24, 2019

Tool featured · Hebrew

### [A tool for checking the security of a website’s client-side libraries](https://internet-israel.com/פיתוח-אינטרנט/בניית-אתרי-אינטרנט-למפתחים/מודול-לבדיקת-אבטחה-של-ספריות-צד-לקוח-של/)

מודול לבדיקת אבטחה של ספריות צד לקוח של אתר

A walkthrough of my is-website-vulnerable command-line tool for identifying vulnerable JavaScript libraries on websites.

Internet Israel

Oct 29, 2017

Security guidance credited · Hebrew

### [Avoid child\_process.exec when running commands in Node.js](https://internet-israel.com/פיתוח-אינטרנט/בניית-אתרי-אינטרנט-למפתחים/אל-תשתמשו-ב-child_process-exec-כדי-להריץ-פקודות-ב-node-שלכם/)

אל תשתמשו ב-child\_process.exec כדי להריץ פקודות ב-node שלכם

Credits my review for flagging a potential security issue in branch-lint and motivating safer command execution practices.

Thomas Gentilhomme

Tool referenced in book · French

### [Become a Node.js Developer](https://docs.google.com/document/d/1JHgmEFkc8Py4XSuCB8_DQ5FFEJoogyeninFK6ucTd4o/edit?tab=t.0#heading=h.7urhd3dh4541)

My npq tool is referenced in Thomas Gentilhomme’s French-language Node.js book, as recorded in the project’s media coverage references.

For articles I authored, explore [writing published elsewhere](/writing#elsewhere-title). Reports and chapters are collected under [Research](/research/reports).