I'm a software engineer based in the UK, mostly working with Ruby. I’ve spent over a decade working in the world of package management and software dependencies — building tools to make open source more understandable, discoverable, and sustainable.
These days I’m focused on Ecosyste.ms, a project that maps dependency networks across open-source ecosystems to identify the projects that really matter — the ones everything else relies on. It builds on ideas from Libraries.io, which I started and later sold to Tidelift, and takes the concept further with broader data coverage and deeper analysis.
I also created Octobox, which helps developers manage GitHub notifications, and 24 Pull Requests, an initiative to encourage open-source contributions during December.
- Jekyll Stats Plugin
- Federated Package Management and the Zooko Triangle
- Package Managers Devroom at FOSDEM 2026: Schedule Announced
- Why JavaScript Needed Docker
- Docker is the Lockfile for System Packages
- Typosquatting in Package Managers
- How I Assess Open Source Libraries
- Supply Chain Security Tools for Ruby
- Building Ecosyste.ms Polite API Rate Limits
- Slopsquatting meets Dependency Confusion
- semgrep-codeql - Converted security rules fromcodeql to semgrep format.
- jekyll-stats - Jekyll plugin that generates site statistics
- typosquatting - Detect potential typosquatting packages across package ecosystems
- sbom - Parse, generate, and validate Software Bill of Materials (SBOM)
- oss-community-benchmarks - A benchmark framework where maintainers define what good AI-generated code looks like for their ecosystem.
- swhid - Generate and parse SoftWare Hash IDentifiers (SWHIDs)
- hanami-sprockets - An alternative to hanami-assets that doesn't rely on npm
- sidekiq-mcp - A Sidekiq plugin that provides an MCP (Model Context Protocol) server for LLMs to interact with Sidekiq queues, stats, and failed jobs
- json-schema-diff - Semantic diff for JSON files using JSON Schema metadata
- vers - A Ruby gem for parsing, comparing and sorting versions according to the VERS spec.