Open-source maintainer focused on system transparency and software supply-chain security.
Co-lead of OWASP CycloneDX, working on the specification and tooling ecosystem.
Helping systems explain what they actually contain, instead of leaving everyone to guess and hope for the best.
I contribute to the CycloneDX specification and maintain tooling that generates CycloneDX SBOMs and other system transparency artifacts across multiple ecosystems.
CycloneDX goes beyond traditional Software Bills of Materials (SBOMs) and supports system transparency across modern software supply chains.
My tools support projects built with:
- Python (venv, Poetry, Pipenv, uv, PDM, Conda, etc.)
- Node.js (npm, yarn, etc.)
- PHP (Composer)
- Build systems such as Webpack, esbuild, Bun-build, and similar tooling
Helping developers and organizations understand what actually runs inside their software, which is more difficult than it should be.
| Project | Ecosystem | Description |
|---|---|---|
| cyclonedx-python | Python | Generate CycloneDX SBOMs for everything Python |
| cyclonedx-python-lib | Python | CycloneDX library |
| cyclonedx-node-npm | Node.js | Generate CycloneDX SBOMs for npm |
| cyclonedx-node-yarn | Node.js | Generate CycloneDX SBOMs for yarn |
| cyclonedx-webpack-plugin | Webpack | SBOM generation during builds with Webpack |
| cyclonedx-esbuild | esbuild & Bun | SBOM generation for esbuild-compatible build systems |
| cyclonedx-javascript-library | JavaScript/TypeScript | CycloneDX library |
| cyclonedx-php-composer | PHP | Generate CycloneDX SBOMs for Composer |
| cyclonedx-php-library | PHP | CycloneDX library |
| cyclonedx-node-module | Node.js | Hub for Node.js CycloneDX SBOM tooling and documentation |
| packageurl-php | PHP | PackageURL library |
| rfc3987-syntax | Python | RFC 3987 (IRI) library |
| py-serializable | Python | Serialization utilities |
If you rely on the tools or libraries I maintain, consider sponsoring the work.
Because servers, CI pipelines, dependency updates, and security fixes are not powered by appreciation alone.
… those dumb metrics that barely mean anything …