# Supply chain research — Liran Tal

Incident analysis and open-source defenses for the dependencies, source code, and development tools that applications trust.

Canonical: https://lirantal.com/research/supply-chain-security

## The event-stream backdoor

Danny Grander and I co-authored a December 2018 post-mortem of the event-stream compromise. We traced the addition of the malicious flatmap-stream dependency and its targeting of the Copay cryptocurrency wallet.

The analysis connects maintainer trust, dependency changes, and a targeted payload. It builds on the wider community’s investigation and credits the people who helped reverse engineer the incident.

*   [Read the co-authored event-stream post-mortem ↗](https://snyk.io/blog/a-post-mortem-of-the-malicious-event-stream-backdoor/)

## Defending source-code review

I maintain anti-trojan-source to detect Unicode patterns that can conceal malicious intent in source code. Its checks help surface content that can look different to a reviewer than it behaves to a compiler or interpreter.

The tool implements defenses for the Trojan Source attack class. The repository documents its supported checks and integrations.

*   [Explore anti-trojan-source ↗](https://github.com/lirantal/anti-trojan-source)

## Checks where dependencies enter

lockfile-lint and npq bring security checks closer to dependency installation and review. lockfile-lint validates dependency sources against project policies; npq exposes package-health and security signals before an install.

The same trust questions now reach agent skills and MCP tools. My recent AI security research follows that transition from conventional dependency chains to the resources and capabilities an agent can acquire.

*   [lockfile-lint ↗](https://github.com/lirantal/lockfile-lint)
*   [npq ↗](https://github.com/lirantal/npq)

## At a glance

Research approaches

Incident analysis & defensive tools

Focus

npm, source review & developer workflows

[Sources & attribution ↓](#sources)

## Sources & attribution

*   [event-stream post-mortem · Danny Grander & Liran Tal, 2018 ↗](https://snyk.io/blog/a-post-mortem-of-the-malicious-event-stream-backdoor/)
*   [Source-code defenses · anti-trojan-source ↗](https://github.com/lirantal/anti-trojan-source)
*   [Package installation checks · npq ↗](https://github.com/lirantal/npq)
*   [Original lockfile injection research · Snyk, 2019 ↗](https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/)