I'm a software engineer based in the UK, mostly working with Ruby. I’ve spent over a decade working in the world of package management and software dependencies — building tools to make open source more understandable, discoverable, and sustainable.

These days I’m focused on Ecosyste.ms, a project that maps dependency networks across open-source ecosystems to identify the projects that really matter — the ones everything else relies on. It builds on ideas from Libraries.io, which I started and later sold to Tidelift, and takes the concept further with broader data coverage and deeper analysis.

I also created Octobox, which helps developers manage GitHub notifications, and 24 Pull Requests, an initiative to encourage open-source contributions during December.

• The Nine Levels of JavaScript Dependency Hell
• Making git-pkgs feel like Git
• The Package Management Landscape
• How Dependabot Actually Works
• git-pkgs: explore your dependency history
• Open Source Activity in 2025
• Community Tools Bring Lockfile Support to GitHub Actions
• Categorizing Package Manager Clients
• Categorizing Package Registries
• The Compact Index: How Bundler Scales Dependency Resolution

• diffoscope - Ruby bindings for diffoscope - Compare packages, tarballs, files, URLs, or package URLs
• git-pkgs - A git subcommand for analyzing package/dependency usage in git repositories over time
• gitlab-faraday - Ruby wrapper for the GitLab REST API, a fork of github.com/NARKOZ/gitlab updated to use Faraday
• grass-ruby - A fast Sass compiler for Ruby, powered by grass (Rust)
• dirhash - Generate Go module zip digests compatible with sum.golang.org
• go-bundler - Go-style imports for Ruby
• changelog-parser - Parse changelog files into structured data
• semgrep-codeql - Converted security rules fromcodeql to semgrep format.
• jekyll-stats - Jekyll plugin that generates site statistics
• typosquatting - Detect potential typosquatting packages across package ecosystems