Supply chain security research — packages, pipelines, dependencies.
TeamPCP's endgame: LiteLLM's PyPI wheel backdoored post-build, .pth system-wide persistence, and why AI gateways are a new class of supply chain target.
Package poisoning, dependency confusion, typosquatting, and build-time attacks across npm, PyPI, Cargo, and more.
GitHub Actions, Jenkins, CircleCI — runner credential theft, Pwn Request patterns, and pipeline backdoors.
Model supply chains, poisoned fine-tuning datasets, inference infrastructure, and prompt injection via packages.
Shift-left security architecture, SAST/DAST integration, secrets management, and developer security tooling.
