Suggestions
Edward Thomson
Open Source, Product Management, Software Development
Edward Thomson is a skilled Product Manager with extensive experience in the developer tools industry, currently focusing on software supply chain security at Stacklok. He has a strong background in leading product teams, developing developer tools, and working as a Software Engineer.
Edward's career highlights include building version control tools at prestigious companies like SourceGear, Microsoft, and GitHub, as well as CI/CD tools at GitHub and the Frontend Cloud at Vercel. He played a pivotal role in merging pull requests, introducing GitHub Actions, acquiring and managing npmjs.com, and launching various compute, storage, and network products at Vercel.
With a solid educational foundation in Mathematics, Computer Science from the University of Illinois Urbana-Champaign, and Computer Science Engineering from Parkland College, Edward has honed his expertise in the technology sector.
His impressive work history includes roles such as Director of Product Management at Vercel, Staff Product Manager at GitHub, and Principal Program Manager at Microsoft. Edward's diverse experience also encompasses senior software engineering positions at GitHub and Microsoft, along with strategic roles at other prominent tech organizations.
Edward Thomson is noted for his contributions to open source software development, public speaking engagements at conferences, podcast appearances, and active involvement in volunteering initiatives. His extensive professional background underscores a deep commitment to innovation, collaboration, and industry leadership.
Highlights
I'm so impressed by both the engineering and the security analysis that we have at Stacklok. We redesigned the scanning mechanism that we use for our Trusty product that performs dependency analysis and threat detection — now it can analyze new packages in the public registries incredibly quickly, look for potentially malicious packages, and flag them to our research team.
Luke Hinds outlines how we found a nasty package within minutes of it being published, outlines some of our techniques for threat analysis, and explains how we discovered what this package attempting to leverage.
At Stacklok, we've been busy analyzing software in various package registries, including npm, to identify potential vulnerabilities. Attackers often target these registries due to their widespread use and high value. We recently published a blog post that illustrates some of the techniques we've encountered. Check it out for a real-life example of a harmful npm package.
Read the blog post here: https://lnkd.in/eaDJ-nfW #cybersecurity #npm #softwaresecurity #vulnerabilities
