
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
Reproduce the failure. Check the fix.
A test fails intermittently. Your coding agent changes the code. One passing retry leaves you guessing.
FailTrace repeats the same check, saves a failing baseline, and checks the proposed fix against it. Use the CLI or MCP tools to get trial results, a smaller reproducer, and evidence your agent can inspect before accepting a patch.
Local execution. No AI API, account, or telemetry required. Keep your existing test runner and assertions.
With Node.js 22.12+ and npm, run this in any working directory:
npx --yes failtrace@1.3.0 demo

An original, controlled CLI example with abridged output and edited timing. Static walkthrough · Static poster · Demo details
The demo reduces six input items to ["BUG"], rejects a patch that crashes for another reason, and checks a working patch. It saves the evidence in .failtrace/ and prints a replay command. These are example outcomes, not performance measurements; a passing sample does not prove a bug is gone.
Connect the local stdio MCP server through your client's configuration:
npx --yes failtrace@1.3.0 mcp --cwd "/absolute/path/to/your/project"
Copy the MCP configuration and check the connection →
Your client launches this command. Running it alone in a terminal waits for MCP requests. The guide includes Windows setup.
Then ask your agent:
Use FailTrace to capture this test failure before editing. Choose the exact test or failure message, save a bounded baseline, and inspect the matching trial. After the change, verify against that baseline and explain any unrelated errors or incomplete evidence.
The seven MCP tools share the CLI's Core engine. They retain the failure signature and investigation evidence across repetition, comparison, regression search, minimization, verification and replay. Agents can retrieve saved trial and log pages without rerunning the command. Shell-capable agents can also use the CLI with --json.
Follow an exact NUnit or Unity test through a fix. Each attempt gets a fresh NUnit 3 report. Missing or skipped tests and unrelated failures stay inconclusive, so an agent cannot accept them as evidence that the selected test passed.
Connect your test or try the original EditMode example →
NUnit support is included in 1.3.0 through CLI and MCP. The documented Unity validation covers the Windows EditMode example.
From your project, replace the command and message with your own:
npx --yes failtrace@1.3.0 run "npm test -- checkout" --repeat 20 --stderr-contains "checkout failed"
Each trial saves its output. Exit 1 can mean the target failure was recorded; inspect the result before retrying. To check a patch, capture a baseline before editing.
| Your next question | Command |
|---|---|
| How often does this failure appear? | run |
| What differs between a healthy and failing trial? | compare |
| Which Git change introduced it? | bisect |
| What input is enough to reproduce it? | minimize |
| What happened after the proposed fix? | verify |
| How can I replay this investigation? | bundle |
Command reference · Literal executable arguments · Reusable project scripts
FailTrace reports observations under the chosen settings. Verify separates a target observed, a healthy sample without that target, and inconclusive evidence. Bisect reports a sampled first-parent boundary; minimization rechecks its result without promising the smallest possible input.
Commands run with your permissions, and process cleanup is best effort. Retained stdout/stderr is capped by default at 16 MiB per trial and 256 MiB per run or bisect/minimization. Previous investigations accumulate separately. Review logs, commands and selected files before sharing; bundles still require the target's dependencies and setup.
Result and exit-code reference · Resource limits · Storage inventory · Bundle guide
The quick start uses published 1.3.0: npm installation options, GitHub release, and MCP Registry entry. The source prepares 1.4.0; installation examples remain on the verified public version until publication completes. See the changelog.
FAQs
Reproduce, isolate, and minimize failures, then verify proposed fixes.
The npm package failtrace receives a total of 26 weekly downloads. As such, failtrace popularity was classified as not popular.
We found that failtrace demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.