Trust & Safety Specialist I (npm) at GitHub · Junior, B.S. Cybersecurity at Arizona State University
I build security tooling and run an enterprise-grade home lab, and I learn by breaking things on purpose.
- Trust & Safety: Protecting the npm ecosystem from malicious packages and abuse at GitHub.
- Security tooling: Building a Rust malware and supply-chain analysis platform with sandboxed detonation.
- Infrastructure: Multi-host Proxmox, OPNsense, VLAN segmentation, SSO with MFA, and a SIEM-backed SOC.
- Development: Shipping tools in Go, Rust, TypeScript and Python to fill real infrastructure gaps.
A self-hosted IPAM and service mapper that visualizes hardware, compute and network relationships with live topologies and real-time telemetry.
- Now: v0.4.6 in progress, with a session-token security fix and topology map performance fixes.
- Next: clean-room rewrite in Go + TypeScript, now in private alpha (0.2.0):
- A single binary served over TLS, backed by PostgreSQL and NATS JetStream.
- A tamper-evident audit chain and a transactional outbox for every change.
- Bounded discovery scans, TCP/HTTP monitors with alerts, and durable, fenced runs that recover from crashes.
- Snapshot and clean-host restore.
A malware and supply-chain analysis platform in Rust for repositories, npm packages and single files. It reports what an artifact does, why that's suspicious and which evidence supports it.
- Rule-based static scanning: download-and-execute chains, dynamic eval, credential access, exfiltration, obfuscated payloads, embedded binaries.
- npm supply-chain analysis: lockfile integrity, install scripts, typosquatting, dependency confusion, registry signals and OSV vulnerabilities.
- Detonation inside a pinned gVisor sandbox, refused when the sandbox isn't available.
- Reproducible, evidence-backed reports in JSON, SARIF and Markdown. Nothing is skipped silently.
- 🏴☠️ Davy Jones Locker: a CLI-first smart media parser in Go. The backend is complete and in live testing.
My home lab is being rebuilt into a hardened, always-on production core plus an isolated cyber range.
| Hosts | CPU | RAM | VMs | VLANs |
|---|---|---|---|---|
| 6 | 58 cores / 112 threads | 216 GB | 16 | 14, default-deny |
- Security: Wazuh SIEM, Suricata IDS on a mirror port and at the edge, Greenbone vulnerability scanning.
- Identity: FreeIPA with an internal PKI, and Authentik SSO with MFA on every admin UI.
- Cyber range: an isolated Active Directory attack/defend environment for detection engineering, watched by the production SOC.
- Resilience: 3-2-1 backups through Proxmox Backup Server, with quarterly restore tests and written runbooks.
- Infrastructure as code: Ansible, OpenTofu and NetBox as the source of truth. Every change goes through a pull request.
"In a world of pre-built solutions, I prefer to build my own."