andrew

KO | EN

gitlite — search

#ai #llm #golang #android #rust #deep-learning #docker #nodejs #macos #java #cli #vue #security #pytorch

(★ 10)

Content for GitHub profile

andrew Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

### Hey 👋

I'm a software engineer based in the UK, mostly working with Ruby. I’ve spent over a decade working in the world of package management and software dependencies — building tools to make open source more understandable, discoverable, and sustainable.

These days I'm focused on [Ecosyste.ms](https://github.com/ecosyste-ms), a project that maps dependency networks across open-source ecosystems to identify the projects that really matter. It builds on ideas from [Libraries.io](https://github.com/librariesio/libraries.io), which I started and later sold to Tidelift, and takes the concept further with broader data coverage and deeper analysis.

I'm also building [git-pkgs](https://github.com/git-pkgs/git-pkgs), a git subcommand that tracks dependency changes across your repository's history. It indexes lockfiles over time so you can see who added each dependency, when, and why, along with vulnerability scanning and supply chain security features.

I also created [Octobox](https://github.com/octobox/octobox), which helps developers manage GitHub notifications, and [24 Pull Requests](https://github.com/24pullrequests/24pullrequests), an initiative to encourage open-source contributions during December.

I write about package managers, dependency resolution, and software supply chains at [nesbitt.io/package-managers](https://nesbitt.io/package-managers/).

### Latest Blog Posts

- [This Week in Package Management: 15 August 2026](https://nesbitt.io/2026/08/15/this-week-in-package-management.html)
- [How This Blog Is Built](https://nesbitt.io/2026/08/14/how-this-blog-is-built.html)
- [Supplier Security Questionnaire](https://nesbitt.io/2026/08/13/supplier-security-questionnaire.html)
- [Shared Code Between Package Managers](https://nesbitt.io/2026/08/11/package-manager-library-reuse.html)
- [This Week in Package Management: 8 August 2026](https://nesbitt.io/2026/08/08/this-week-in-package-management.html)
- [The Software Stewardship Lab](https://nesbitt.io/2026/08/07/the-software-stewardship-lab.html)
- [A year of AI disclosure in critical packages](https://nesbitt.io/2026/08/06/a-year-of-ai-disclosure-in-critical-packages.html)
- [brew install actions/checkout](https://nesbitt.io/2026/08/04/brew-install-actions-checkout.html)
- [This Week in Package Management: 1 August 2026](https://nesbitt.io/2026/08/01/this-week-in-package-management.html)
- [The AI Phrasebook](https://nesbitt.io/2026/07/31/the-ai-phrasebook.html)

### Latest Repos

- [package-manager-library-reuse](https://github.com/andrew/package-manager-library-reuse) - Survey of which libraries package managers themselves depend on, vendor, or link against
- [homebrew-actions](https://github.com/andrew/homebrew-actions) - Install GitHub Actions from a Homebrew tap
- [critical-ai-scan](https://github.com/andrew/critical-ai-scan) - Survey of explicitly disclosed AI involvement in the git history of critical open source repositories, using the CHAOSS disclosure detectors
- [package-name-prefixes](https://github.com/andrew/package-name-prefixes) - Prefix analysis of package names across PyPI, npm, crates.io, rubygems, hex, hackage and NuGet
- [bundler-resolver-logger](https://github.com/andrew/bundler-resolver-logger) - Experimental structured tracing for Bundler's PubGrub resolver
- [jekyll-standard-site](https://github.com/andrew/jekyll-standard-site) - Jekyll plugin that emits standard.site verification artifacts
- [pycon](https://github.com/andrew/pycon) - Data collection and analysis for a PyCon talk on GitHub Actions security across Python packages.
- [weekend-at-bernies](https://github.com/andrew/weekend-at-bernies) - Data collection for Weekend at Bernie's blog post
- [vid](https://github.com/andrew/vid) - Content-addressed vulnerability identifiers
- [omni_git](https://github.com/andrew/omni_git) - A PostgreSQL extension that stores git repositories in database tables and serves the git smart HTTP protocol, turning Postgres into a git remote.

andrew

andrew Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

andrew

andrew Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README