I work on software supply-chain security at Aikido Security, focusing on finding malicious behavior in open-source ecosystems at scale. I research real-world attacks, design detection signals, and build systems that turn messy package and maintainer data into clear security findings.
‍
‍Research & Analysis
- Supply-chain threat research across open-source ecosystems
- Analysis of real-world attacks and systemic failure modes
- Adversary behavior and tradecraft tracking

‍Detection & Defense
- Designing signals for malicious package detection
- Translating raw data into actionable security findings
- Balancing precision, scale, and explainability

‍Ecosystem-Level Work
- Registry-scale analysis of packages and maintainers
- Identifying structural weaknesses in open-source platforms
- Cross-ecosystem risk and abuse pattern discovery

‍Tooling & Systems
- Building systems for large-scale package analysis
- Detection pipelines and internal security tooling
- Rule engines and risk-scoring frameworks
‍
Communication & Impact
- Public research writing and incident communication
- Industry discussions on supply-chain security
- Advocacy for safer open-source ecosystems