Liran Tal
Director of Developer Advocacy at Snyk, GitHub Star, Open Source Security Champion
Señors @ Scale host Neciu Dan sits down with Liran Tal, Director of Developer Advocacy at Snyk and GitHub Star, to unpack NPM malware, maintainer compromise, MCP attacks, toxic flows, and why AI-generated code is statistically insecure without the right guardrails. Liran shares real incidents from the Node and open source ecosystem, how Snyk and tools like NPQ help developers build safer workflows, and why security at scale starts with developers, not firewalls.
🎧 New Señors @ Scale Episode
This week, I spoke with Liran Tal, Director of Developer Advocacy at Snyk, longtime open source maintainer, and GitHub Star, about what security at scale really looks like when you are shipping JavaScript and Node.js into production in 2025.
Liran has been around security since the BBS and IRC days, but his focus has always been on developers and real software delivery. In this episode, we unpack NPM malware, maintainer compromise, MCP attacks, AI generated code, and the uncomfortable gap between “we ship fast” and “we actually understand our risk surface.”
Rather than generic OWASP checklists, this conversation stays close to incidents, patterns, and the habits that make or break teams.
⚙️ Main Takeaways
1. Security at scale is now a developer problem, not just an AppSec problem
For a long time, security meant network perimeters, firewalls, and a security team that dropped a PDF on you every six months. The last decade flipped that model. The main attack surface today is application code, third party packages, and the tools developers use to build and deploy.
Developer-first security means bringing scanning and fixes into the CLI, IDE, and pull request. It removes the backlog and replaces it with fast, contextual feedback where work actually happens.
The core idea: security only scales when developers participate by default, not as an escalation path.
2. NPM supply chain risk is about people, not just packages
Vulnerable dependencies get headlines, but the modern attacks Liran describes target maintainers, not code.
Weak passwords, reused credentials, unprotected accounts, old maintainers with forgotten access — once attackers compromise a maintainer, they can publish malicious versions, harvest tokens, and infect other repositories in a chain reaction.
Even worse are internal workflows that increase the blast radius. A common example:
“Upgrade everything to latest” in CI.
It sounds efficient, but in CI you expose environment variables, private modules, and proprietary source. If a malicious package slips through, your CI pipeline becomes an exfiltration tool.
This is the real threat. Not just vulnerable code, but untrusted people, untrusted processes, and untrusted defaults.
3. Healthy dependency habits are real security controls
Liran built NPQ, a small CLI that intercepts npm install and performs health checks before the package lands on your system.
Checks include:
- recent publish date
- known vulnerabilities
- suspicious release patterns
- activity and maintenance signals
It’s not meant to be perfect. It’s meant to stop developers from installing packages published seven hours ago or typosquatted variants that look legitimate.
There’s a broader lesson here:
small, lightweight guardrails outperform heavyweight audits.
Pin versions. Upgrade intentionally. Add friction in the right places.
4. AI, MCP, and prompt injection create new classes of security problems
This episode goes deep into MCP servers and AI agent security.
MCPs introduce multiple layers of risk:
- malicious MCP servers poisoning tool behavior
- legitimate MCP servers containing classic security bugs
- prompt injection that alters agent logic or extracts protected data
- toxic flows where data from one repo triggers actions in another
AI browsers amplify this. Invisible Unicode characters can carry instructions that humans never see (“Glassworm”). Shadowed tools can override intended commands. Prompt injection is not theoretical — it is inherent.
Liran’s message is clear:
traditional AppSec patterns do not cover how agents and MCPs behave.
You need isolation, scanning, version pinning, and layered validation.
5. AI generated code is statistically insecure — you need a feedback loop
Models train on real code. Real code contains vulnerabilities. So AI-generated code will inevitably drift into insecure patterns like:
- unsafe path concatenation
- injection vulnerabilities
- unsafe default configuration
- exposure of sensitive data
Snyk has tested this across multiple models using prompts demanding secure output. The results still vary.
The fix is tying scanning directly into the agent loop:
agent writes code → Snyk scans → feedback returned → agent refactors → repeat until secure.
This shifts AI development from “trust the model” to “verify by construction.”
6. Real incidents show how tiny details uncover massive backdoors
The stories Liran shares ground everything in reality:
- EventStream showed how precise attackers can be when they understand the dependency graph.
- XZ Utils revealed a years-long, social-engineering-driven supply chain attack that nearly compromised SSH on Linux.
- It was discovered because one engineer noticed a few hundred milliseconds of delay on disconnect.
Security failures rarely arrive with alarms. They appear as small anomalies that curious engineers refuse to ignore.
Liran also shares more everyday issues: plaintext passwords discovered during a migration, XSS caused by lax UX permissions, and weak governance that let anonymous actions write unsafe HTML.
The through-line:
security is a human practice, not a theoretical discipline.
🧠 What I Learned
- Developer workflows shape your security posture more than any static checklist.
- Supply chain risk is deeply tied to identity, trust, and maintainer security.
- Guardrails like NPQ prevent entire classes of mistakes.
- AI coding and MCPs create new threat surfaces that don’t map cleanly to OWASP.
- Prompt-level instructions cannot ensure secure output — automated scanning can.
- UX decisions can become attack vectors without anyone noticing.
💬 Favorite Quotes
“Security at scale is a complex challenge.”
“AI generated code is not always secure.”
“Security and UX must work together.”
“You probably don’t want to install something that was published seven hours ago.”
“If your CLI has command injection and the agent calls it, that’s a breach waiting to happen.”
🎯 Also in this Episode
- How NPM became the highest-value target in modern software
- Why local MCP servers are riskier than remote ones
- Toxic flows and the GitHub and Cursor incidents
- The mechanics of SQL injection and command injection inside MCP servers
- Why Liran will not install browser extensions or AI browsers
- What real maintainer compromise looks like in practice
Resources
More from Liran:
Node Security Books by Liran Tal
GitHub
NPQ Package Checker
Snyk Blog
LinkedIn
🎧 Listen Now
🎧 Spotify
📺 YouTube
🍏 Apple Podcasts
Episode Length: 57 minutes on modern security, supply chain risk, developer workflows, and how to ship safely with AI and open source.
Happy shipping,
Dan
💡 More Recent Takeaways
Señors @ Scale host Neciu Dan sits down with Craig Abbott, Principal Accessibility Specialist at TetraLogical and the former Head of Accessibility at the UK's Department for Work and Pensions, one of the largest government departments in the country, where he built a dedicated accessibility practice from nothing and open sourced the DWP Accessibility Manual. Craig has over 15 years in user centred design and has led accessibility work across the public sector and at Elastic. From what sustainable accessibility actually means and why third party audits alone don't get you there, to the three C's of compliance, culture and capability, to running screen readers in VMs without expensive licences, to accessibility acceptance tests in CI with Playwright, Cucumber and Guidepup, to why compliance does not mean usable, this is the accessibility conversation for teams who want it to survive the person who cares about it.
Señors @ Scale host Neciu Dan sits down with Carmen Huidobro, CTO at Incredible Bee in Vienna, where she builds products and helps teams figure out what should be automated and what should stay in the hands of users. Carmen has spent 17 years in tech, almost all of it freelancing, working across Objective-C, Ruby on Rails, the web, mobile, hardware, and even ABAP inside an SAP consultancy, plus five years in developer relations and developer education. Her argument is that the generalist versus specialist debate misses the point: the durable skill is being an expert at adapting. From adding a local Mistral model to a twenty-year-old macOS app without betraying the people who use it, to the refugee hackathon project the City of Vienna still runs a decade later, to why she won't take money from junior developers, this is a conversation about the skills that survive the shift.
Señors @ Scale host Neciu Dan sits down with Marko Gaćeša, Head of Product at Semaphore, the agent-native CI/CD platform, and the first product guest on the show. Marko is a serial entrepreneur whose career spans developer tools, IoT, industrial automation and enterprise SaaS, including founding Dry Tools and serving as Chief Product Officer at Alchemy Cloud, with earlier work in domains like medical equipment where quality is non-negotiable. From why testing rather than coding is now the bottleneck, to what agent-native CI/CD actually means when developers live inside their coding agent, to how SemAI attacks flaky tests and automates migration off GitHub Actions, to pricing a platform where a minute of CI is not the same minute everywhere, this is the product side of developer tooling from someone shipping it.
Señors @ Scale host Neciu Dan sits down with Maxim Salnikov, AI Dev Tools Solution Engineer at Microsoft, where he leads AI native development enablement for over 100 enterprise customers of Microsoft and GitHub in Norway. Maxim has been building for the web since the late 90s and spends his days inside real enterprise dev teams across finance, energy, agriculture, and pure software companies, watching AI adoption succeed and fail. From why adoption is a change management problem rather than a technology one, to the anatomy of an AI harness and the external layer successful companies build on top of it, to the context engineer and agent ops roles now appearing in team topologies, to managing agent skills as versioned dependencies instead of letting them pollute the repo, this is the enterprise AI adoption conversation from someone who sees a hundred versions of it.
📻 Never Miss New Takeaways
Get notified when new episodes drop. Join our community of senior developers learning from real scaling stories.
💬 Share These Takeaways
Want More Insights Like This?
Subscribe to Señors @ Scale and never miss conversations with senior engineers sharing their scaling stories.