# Research by Liran Tal — papers, patents & security disclosures

Explore Liran Tal’s co-authored research papers, patent application, CVEs, lockfile injection research, OWASP npm security guidance, and AI security work.

Canonical: https://lirantal.com/research

Research

# Investigating how systems fail.

I study the trust we place in software: the dependencies we install, the code we review, and the tools we give to AI agents. Here are the findings, disclosures, and defenses that came out of that work.

Co-authored preprints

3

[Published on arXiv](/research/papers)

Active credited advisories

41

[GitHub Advisory Database](/research/advisories)

Critical-severity advisories

7

Among the active records

Original lockfile research

2019

[Extended at Black Hat EU](/research/lockfile-injection)

[Citations & h-index on Google Scholar ↗](https://scholar.google.com/citations?user=J3pv7lMAAAAJ&hl=en)

Research snapshot: Oct 19, 2026. Counts cover the work listed here. Citation totals are available on my Google Scholar profile.

## 01 / Explore the research

From a finding to a fix, a paper, or a shared practice.

Co-authored preprints

### [Papers →](/research/papers)

Research on agent skills, the repeatability of AI security review, and vulnerability remediation.

Software engineering · Filed 2013

### [Patents →](/research/patents)

A patent application connecting manual testing, screen states, and contextual software localization.

Coordinated vulnerability disclosure

### [CVEs & advisories →](/research/advisories)

Publicly credited disclosures across developer tooling, web packages, runtimes, and MCP servers.

Software supply chain · 2019 →

### [Lockfile injection →](/research/lockfile-injection)

Original 2019 research, lockfile-lint, and the GitLab work that extended it at Black Hat Europe 2021.

Developer security guidance · 2019 →

### [npm security →](/research/npm-security)

The original npm security best practices, their adoption by OWASP, and ongoing package-manager guidance.

AI & agentic security · 2025 →

### [AI & agents →](/research/ai-security)

Agent skill ecosystem threats, MCP vulnerability disclosures, and benchmarks for AI security tools.

Incident analysis & defensive tooling · 2018 →

### [Supply chain →](/research/supply-chain-security)

The event-stream post-mortem, source-code defenses, and tools that turn research into development safeguards.

## 02 / Recent papers

Co-authored research, with the full methods and evidence.

[All papers →](/research/papers)

October 2026

arXiv · Preprint

### [VulnBump: A Benchmark for Fixing Vulnerable Dependencies in Real Projects While Keeping the Build and Tests Green ↗](https://arxiv.org/abs/2610.17374)

A benchmark of 307 dependency upgrades across 43 repositories, evaluating whether AI agents fix vulnerabilities while preserving successful builds and tests.

Gabija Pasiunaite, Ryan McMorrow, Brian Clark, Liran Tal, and Luke Tu

[Read PDF](https://arxiv.org/pdf/2610.17374) [DOI: 10.48550/arXiv.2610.17374](https://doi.org/10.48550/arXiv.2610.17374)

June 2026

arXiv · Preprint

### [Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice? ↗](https://arxiv.org/abs/2606.15762)

Repeated vulnerability scans on JavaScript code explore the consistency of LLM security review and how it complements deterministic static analysis.

Liran Tal, Johannes Kloos, Arsenii Rudich, Stephen Thoemmes, and Manoj Nair

[Read PDF](https://arxiv.org/pdf/2606.15762) [DOI: 10.48550/arXiv.2606.15762](https://doi.org/10.48550/arXiv.2606.15762)

## 03 / Research in practice

What happens after publication matters, too.

### From lockfiles to Black Hat

GitLab’s Dennis Appelt and Greg Johnson extended my 2019 lockfile injection research to more techniques and ecosystems, presenting their work at Black Hat Europe 2021.

[Follow the research trail →](/research/lockfile-injection)

### A foundation for OWASP guidance

The npm security best practices I co-authored with Juan Picado became the original basis of OWASP’s NPM Security Cheat Sheet.

[Read about the OWASP connection →](/research/npm-security)