Open-source maintainer focused on system transparency and software supply-chain security.
Co-lead of OWASP CycloneDX, working on the specification and tooling ecosystem.
Helping systems explain what they actually contain, instead of leaving everyone to guess and hope for the best.
I contribute to the CycloneDX specification and maintain tooling that generates CycloneDX SBOMs and other system transparency artifacts across multiple ecosystems.
CycloneDX goes beyond traditional Software Bills of Materials (SBOMs) and supports system transparency across modern software supply chains.
My tools support projects built with:
- Python (venv, Poetry, Pipenv, uv, PDM, Conda, etc.)
- Node.js (npm, yarn, etc.)
- PHP (Composer)
- Build systems such as Webpack, esbuild, Bun-build, and similar tooling
Helping developers and organizations understand what actually runs inside their software, which is more difficult than it should be.
| Project | Ecosystem | Description |
|---|---|---|
| cyclonedx-python | Python packaging | Generate CycloneDX SBOMs for everything Python |
| cyclonedx-python-lib | Python | CycloneDX library |
| cyclonedx-node-npm | Node.js npm | Generate CycloneDX SBOMs for npm |
| cyclonedx-node-yarn | Node.js yarn | Generate CycloneDX SBOMs for yarn |
| cyclonedx-webpack-plugin | Webpack | SBOM generation during builds with Webpack |
| cyclonedx-esbuild | esbuild & Bun | SBOM generation for esbuild-compatible build systems |
| cyclonedx-javascript-library | JavaScript/TypeScript | CycloneDX library |
| cyclonedx-php-composer | PHP Composer | Generate CycloneDX SBOMs for Composer |
| cyclonedx-php-library | PHP | CycloneDX library |
| cyclonedx-node-module | Node.js | Hub for Node.js CycloneDX SBOM tooling and documentation |
| packageurl-php | PHP | PackageURL library |
| rfc3987-syntax2 | Python | RFC 3987 (IRI) library |
| py-serializable | Python | Serialization utilities |
If you rely on the tools or libraries I maintain, consider sponsoring the work.
Behind every stable release is a lot of invisible labor: triaging tickets, reviewing PRs, answering questions, refining designs, and keeping dependencies secure. Appreciation is great, but sustainability needs support.
… those dumb metrics that barely mean anything …