Hi there 👋

I'm a full-stack software engineer with 10+ years experience and a huge passion for Open Source... Full Bio

My current open source activity is highly focused on the JS ecosystem. I have dedicated my time to maintaining and contributing to over 200 open source packages, including some of the top 100 packages on the Npm registry.

Being part of the open source community has been both rewarding and challenging. I take great pride in helping to improve the ecosystem and support the developers who rely on these packages for their projects. I am constantly keeping track of new developments and bug fixes, responding to issues, and developing new features. It is also important to me to ensure accuracy, scalability, and security of the packages that I am involved with. More details in my website.

Standards/Communities I Contribute To

• Member of the Lodash Technical Steering Committee (TSC) since 2025
• Member of the OpenJS AI Collab Space since 2025
• Member of the Webpack Security WG since 2025
• Member of the OpenJS Foundation CNA (CVE Numbering Authority) team since 2025
• TC39 Delegate (OpenJS Foundation) since 2024
• Participant of the TC39 TG3 (Security WG) since 2024
• Node.js Core Collaborator since 2024
• Member of the OpenJS Security Collaboration Space since 2024
• Regular Member of the OpenJS Cross Project Council since 2024
• Member of the Express.js Technical Committee since 2024
• Maintainer of the OSSF Scorercad Monitor and the OSSF Scorecard Visualizer since 2023
• Node.js Releaser since 2023
• Member of the Node.js Performance Team since 2022
• Member of the Node.js Build Team since 2022
• Participant of the TC39 JS outreach groups since 2022
• Member of the Node.js Security WG since 2022
• OWASP (The Open Web Application Security Project) Member since 2022
• Member of the Express.js Triage Team since 2020
• Member of the Yeoman Core Team since 2019

Organizations I Contribute To

• Expressjs
• Yeoman
• OWASP
• Nodejs
• One Beyond (prev: Guidesmiths) and many more...

🏆 Awards

• JavaScriptLandia Awards Leading by Example in 2024
• Snyk Ambassador since 2023
• Docker Captain since 2023
• Google Developer Expert (GDE) for Firebase since 2019
• Most Valuable Professional (MVP) for Developer Technologies from 2023 to 2025
• Auth0 Ambassador from 2020 to 2024

📚 My books

• Dominando o Node.js. Novatec Editora (2025)
• El Gran Libro de Node.js. Marcombo (2024)
• Node.js for beginners. Packt (2024)
• Docker Seguro. Leanpub (2022)
• Cybersecurity handbook. Guidesmiths (2020)
• JavaScript, ¡Inspírate!. Leanpub (2017)

🎙 Top Talks/Interviews/Public Speaking

• What Comes After Chaos? Lessons from Reviving Express and reimagining Lodash
• Node Congress 2025 | What is a Vulnerability and What’s Not? Making Sense of Node.js and Express Threat Models
• DevSecCon: Strengthening the Software Supply Chain and Open Source Projects
• Event in Spanish: Open Source Viernes con @ulisesgascon
• Web Reactiva 292: Mantener node.js sin poder fallarle a millones de programadores con Ulises Gascón
• ¿Qué TECH Cuentas? (Podcast) - Ep. 4 - Cómo es contribuir y mantener proyectos como NODE.JS, con Ulises Gascón
• WeCode2020: Tor Metrics con Firebase (Live Coding)
• JSDayCAN2019: ¿Tu Servidor en NodeJS es vulnerable?
• T3chFest2018: Scraping épico para gente sin APIs
• HackMadrid%27: Node4Hackers Talk and workshop
• Programar es una mierda #61: Se aceptan pull requests

Watch more in my personal website

⚙️ Top Proof of concepts (POCs)

• Using Feature Flags and Canary Releases with Electron
• Node.js Binaries Integrity Checker
• How to do an Azure Blob media content optimization?
• How to use Azure IOT Device Update with custom debian/ubuntu packages?
• How to Synchronize Markdown files with Confluence?
• Use Github Actions to monitor Jenkins agents
• Ontology in the Digital Twins Definition Language universe
• Unlock the Power of IoT with Azure Digital Twin Modeling
• A Comprehensive Proof of Concept Walkthrough about Azure IOT Hub using Node.js
• How to use JSON Schemas and Semantic Versioning for everything?
• How to visualize the Node.js Machines inventory in a Dashboard?
• How to do load tests for an API using K6 and Grafana?
• How to use Terraform and Localstack?

Find more in my repositories

🖋 Top Blog Posts

• Open Source Doesn’t Fail Because of Code!
• The Future of Lodash
• Decoding CVEs: A practical guide to assessing and mitigating security risks
• How Yeoman is Enhancing Security Through Policy Updates
• A New Chapter for Express.js: Triumphs of 2024 and an ambitious 2025
• How Express.js Rebuilt Its Vulnerability Reporting Process
• How does the Official Node.js News Feeder work?
• Dockerize Javascript IOT Applications
• Safely store secrets in Git using Blackbox
• You should use the OpenSSF Scorecard
• Node.js Security Best Practices
• What is a backdoor? Let’s build one with Node.js

Read more in my blog

Sponsors

☕️ Get in touch

It is always a pleasure to hear from fellow developers and tech companies. If you have any potential projects or are looking for help maintaining a foss project, please reach out and contact me 🙂

The best way to contact me these days is through email. Alternatively, I'm also an active member of the OpenJs Foundation Slack group.