Evan Sultanik

Summary: This is an index page of Trail of Bits blog posts by Evan Sultanik, spanning December 2025 back to 2019, covering topics from LLM code generation and dependency analysis to cryptocurrency exchange account takeover and machine learning pickle file exploits. Individual entries describe tools such as Vendetect for detecting copied code via semantic fingerprinting, Deptective for finding dependencies by observing runtime behavior, and PolyFile for mapping file structure.
What you should know: The page is a catalog rather than a single report, but its recurring theme is that software dependencies and file formats carry risk that self-reported manifests and specifications do not capture - Deptective finds packages by watching what software actually needs at runtime, not what it claims.

Read the original at Trail of Bits Blog ↗