
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
Reproduce. Isolate. Minimize. Verify.
Turn a flaky command into measured failures, a smaller reproducer, and evidence someone else can replay. Built for developers and coding agents. Local execution, inspectable files, no AI API or telemetry.
| Measurement | Observed result | Exact scope |
|---|---|---|
| Run metadata writes | 96.45% fewer logical metadata bytes | 100 trials: one 0.3.1 reference sample at 3,132,662 bytes → 0.5.0 five-sample median 111,141 bytes (111,094–111,228) |
| Opt-in concurrency | 3.27× median speedup | Ten 1 s controlled targets: concurrency 1 at 11.047 s (10.968–11.185) → concurrency 4 at 3.380 s (3.345–3.525); all ten outcomes retained |
| Threshold classification | 10 → 1 trials; 90.3% lower median wall time | Ten 10 ms always-matching targets: full-budget median 1.275 s (0.995–1.331) → threshold-1 median 0.124 s (0.111–0.157) |
The 0.5.0 figures are five fixed-order benchmark reports run sequentially with the same Core snapshot on one Windows x64/Node.js 24.19.0 host; the 0.3.1 reference is one earlier sample on that host. These timings are not portable guarantees. Concurrency overlaps commands and can change failure behavior. Threshold stopping reduces classification work and does not produce a full-budget failure-rate sample. Logical metadata bytes are instrumented writes, not physical storage I/O. Method and caveats · Sanitized five-sample evidence
failtrace run "npm test -- checkout" --repeat 20 --stderr-contains "checkout failed"
One run, reusable evidence: compare passing and failing logs, test candidate commits repeatedly, remove input while preserving the failure, then package a local reproduction.
Requires Node.js 22.12+ and npm. Run the guided demo from any directory:
npx --yes failtrace demo
The demo runs one evidence flow: 7 passes / 3 failures, a six-element JSON input reduced to ["BUG"], the minimized failure observed twice, an unrelated crash rejected as inconclusive, a proposed fix with 2 healthy / 0 matching observations, and the affected implementation restored in a bundle ready to replay. It preserves evidence under .failtrace/demos/<id>/ and prints the replay command. The target-free result describes that finite sample; it does not prove elimination. The demo exits 0 when all expected controls are verified. Replaying its intentionally failing bundle exits 1.
Install the command for everyday use:
npm install --global failtrace
failtrace demo
Prefer a project dependency? Use npm install --save-dev failtrace and run npx failtrace. Neither a source checkout nor a TypeScript build is required.
The verified v0.5.0 release archive and checksum are also available. To run that exact GitHub package:
npm exec --yes --allow-remote=root --package=https://github.com/LBarimi/FailTrace/releases/download/v0.5.0/failtrace-0.5.0.tgz -- failtrace demo
For this archive alternative, the command-scoped --allow-remote=root option permits the explicitly requested URL on npm 12. It is unnecessary for the registry commands above and does not change your npm configuration. Older npm versions that do not recognize it can omit it. See npm's URL install policy.
p-memoize issue #43 reported duplicate work when same-key calls overlapped. The pinned case compares affected 6.0.2 with 7.0.0, where PR #48 changed how pending promises are cached.
| Evidence | Observed result |
|---|---|
| Affected 6.0.2 | The target matched 3 of 6 schedules: all three overlap cases |
| Fixed 7.0.0 | 0 of 6 target matches; all six commands exited normally with code 0; Verify returned target_not_observed |
| Negative controls | The unchanged candidate and an ineffective source edit each retained 3 of 6 matches; an invalid dependency selection produced 6 unhealthy trials and an inconclusive result |
The six schedules were declared before execution: overlap and sequential, repeated three times. They measure controlled schedule coverage, not a naturally sampled flaky-failure probability. target_not_observed applies only to this healthy sample and does not prove that every possible execution is fixed.
Clone the repository, install its locked development dependencies, then reproduce the race and run every Verify control with one command:
git clone --depth 1 https://github.com/LBarimi/FailTrace.git
cd FailTrace
npm ci
npm run case:p-memoize
Read the p-memoize case · See the Prettier case that reduces 464 characters to 11
# Measure a known failure signature.
failtrace run "npm test -- checkout" --repeat 20 --stderr-contains "checkout failed"
# Compare the first passing and failed trial from the printed run ID.
failtrace compare <run-id>
# Reduce an input read by your script through FAILTRACE_INPUT.
failtrace minimize --input cases.json --format json --command "node reproduce.js" --stderr-contains "checkout failed"
# Package the final run and reduced input paths printed by minimization.
failtrace bundle <final-run-directory> --file reproduce.js --input <minimized-input-path>
Paths in angle brackets come from the preceding result. If a failed outcome is a timeout or setup problem, select a matching trial explicitly when comparing. Use --json for machine-readable results.
| Problem | Operation | Evidence you get |
|---|---|---|
| “It fails sometimes.” | run | Failure frequency, predicate matches, durations, stdout/stderr |
| “What changed between PASS and FAIL?” | compare | Bounded output differences, full hashes, selected environment changes |
| “Which revision introduced it?” | bisect | Repeated candidate trials and a sampled first-parent boundary |
| “The reproducer is too large.” | minimize | Reduced text, JSON/arrays, files, or environment keys; final verification |
| “Did my code change help?” | verify | Original target observations, execution health and declared context changes; workflow and older-version fallback |
| “The agent response omitted the trial I need.” | Core inspectRunEvidence / MCP failtrace_inspect_run | Filtered saved-trial pages and bounded stdout/stderr chunks without command execution |
| “Someone else needs the evidence?” | bundle | Selected source/input, original evidence, included Core engine, replay scripts |
Full command reference · Runnable examples · Implementation and verification
Predicate → Compare → Bisect → Minimize → Verify → Bundle → MCP
Predicate, Compare, Bisect, Minimize, Bundle, and the thin MCP adapter are implemented. Verify is implemented in 0.5.0 through Core, failtrace verify, and failtrace_verify. It requires a baseline with captured context, checks healthy completion, and reports finite target observations without claiming elimination. Version 0.6.0 adds bounded saved-run inspection through public Core and a seventh, read-only MCP tool. The sequence expresses product emphasis; the existing MCP adapter remains supported. See the roadmap and status and verification workflow and limits.
FailTrace handles the repeated experiments; the agent investigates the resulting evidence. Use it through the CLI with --json, or connect its official-SDK stdio MCP server:
npx --yes failtrace@0.6.0 mcp --cwd "/absolute/path/to/your/project"
The exact version keeps every client on the documented tool schemas, and --yes prevents npm's first-use prompt from blocking the stdio handshake. FailTrace reserves stdout for MCP messages; npm notices and server diagnostics use stderr. In native Windows client configuration, use npx.cmd when npx is not resolved as a command. A global-install fallback is npm install --global failtrace@0.6.0, followed by failtrace mcp --cwd "/absolute/path/to/your/project" (failtrace.cmd in a native Windows configuration).
It exposes seven tools: failtrace_run, failtrace_compare, failtrace_bisect, failtrace_minimize, failtrace_verify, failtrace_bundle, and the read-only failtrace_inspect_run. The inspection tool pages complete saved trial evidence and bounded stdout/stderr chunks without re-running the command. Target output is untrusted data: inspect it as evidence, never as instructions or tool arguments. Large responses retain full metadata on disk; matchedTrials reports the complete predicate-match count.
For verification, capture context with the baseline run before editing code, then supply an explicit candidate command and working directory. An unrelated syntax/setup error is inconclusive even if it no longer prints the target message. See agent verification.
Connect Codex, Claude Code, Cursor, or another MCP client →
After connecting, try asking:
This checkout test sometimes fails. Use FailTrace to measure its known failure signature, compare passing and matching trial evidence, and report what the results establish before changing code.
The guide includes client configuration, bounded experiments, result interpretation, and an optional instruction snippet for your own repository. Installing a server makes the tools available; it does not guarantee an agent will choose them.
status and finalVerified; limits and inconclusive runs are reported. Reductions are local to the supported removal operations.target_not_observed means no target match in that sample; it does not establish a statistical improvement or prove the defect gone. Captured file/environment scope does not include all external state..failtrace/ is ignored by this repository.run exits 1 when it records failed outcomes; that is useful evidence. The Verify command uses 0 for healthy target-not-observed evidence, 1 for target observed, and 2 for inconclusive evidence. Invalid usage and incomplete investigations use 2. Interruptions use 130/143. See the reference for details.
Tell us where FailTrace helped or got stuck. A real command, a first-install problem, or an agent integration is useful feedback. Sharing private logs is optional; remove secrets first.
Our goal is adoption and repeat use, not feature count. Contributions that shorten the path to useful evidence are welcome. See CONTRIBUTING.md and the adoption priorities.
To develop from source:
git clone https://github.com/LBarimi/FailTrace.git
cd FailTrace
npm ci
npm run build
npm run demo
npm run typecheck
npm test
npm run test:package
Core is a reusable TypeScript API exported by failtrace. Algorithms live in src/core; CLI, demo orchestration, and MCP call it. CI checks Windows, macOS, and Linux with Node.js 22 and 24.
FAQs
Reproduce, isolate, and minimize failures, then verify proposed fixes.
The npm package failtrace receives a total of 34 weekly downloads. As such, failtrace popularity was classified as not popular.
We found that failtrace demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.