
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@limulus/delto
Advanced tools
Delto keeps a human-readable backlog — a BACKLOG.md — alongside your code, plus a journal of
completed work (by default under docs/journal/). Every item carries an immutable
three-character ID — a "deltoid" like ∆u2o — that travels with it from the backlog into its
journal entry. Delto comes in two parts: the /delto skill, which teaches a coding agent how
to keep the backlog, and the delto CLI, the deterministic pieces the skill leans on —
minting collision-free IDs, finding eligible work, claiming, and completing.
npx skills add limulus/delto
npx @limulus/delto@1 bootstrap
bootstrap materializes the starter files into a project that has no BACKLOG.md yet: the
backlog itself, the journal README, and a .gitignore entry for delto's local claim ledger.
Drive delto through the skill, usually as /delto <action>:
/delto add — capture new work. Describe it conversationally and the skill mints a fresh
deltoid, writes a well-formed item, and places it in the backlog./delto plan — start on a piece of work. Name an item, or let the skill surface an
eligible one (nothing blocked or already claimed), claim it for you, and plan it./delto complete — accept finished work. The skill writes the item's journal entry, then
removes it from BACKLOG.md, fitting whatever commit workflow you use.Each step maps to a deterministic CLI subcommand (bootstrap, mint, surface, claim,
release, complete) — run any with --help, or read the skill, for the specifics.
A delto BACKLOG.md is plain Markdown. The spec's only hard rules: each item carries a deltoid,
and a trailing ; needs: ∆aaa marks a hard dependency. The rest is up to you — the skill's
examples group items under initiative and epic headings, but that's a convention, not a
requirement.
∆ sigilUsing a non-ASCII character to prefix an ID may seem like a pain to type. However, on macOS, it can be typed with option-J. For other systems and voice to text, the skill informs the agent that either “delto” or “delta” followed by three characters is a deltoid.
Node.js 20 or newer.
FAQs
Keep a backlog. With your code. Give agents context.
The npm package @limulus/delto receives a total of 5 weekly downloads. As such, @limulus/delto popularity was classified as not popular.
We found that @limulus/delto demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.