
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
forgetrail
Advanced tools
ForgeTrail: a persistent development system for building software with AI agents. CLI, Lite protocol, and methodology templates.
Forge the path. Keep the trail.
Keep project decisions, development state, and lessons in the repository so your next AI-assisted session can continue with context.
After one sitting you should have .forgetrail/workflow_tracking.json with the phase you are in, a decision, and a nextSession line. A labeled two-session walk-through is in content/examples/two-session-continuity.md.
Docs: forgetrail.dev/docs · Site: forgetrail.dev
You need a new empty project folder and a coding agent that can read files. Node is optional.
docs/GENESIS.md (what, not how).content/FORGETRAIL_LITE.md to .forgetrail/FORGETRAIL_LITE.md, or run pnpm dlx forgetrail install --lite --with-genesis-stub (Node.js 20+).The shortest supported first task is: create tracking, draft docs/PHASE_1_BRIEF.md, and wait for approval. You do not have to run all seven phases. Full recipe: Try.
| Path | Who uses it | What it is |
|---|---|---|
| Lite | First path | One protocol file. The agent writes tracking. |
CLI (forgetrail) | Node.js 20+ | Installer. Writes Lite or the full template tree. Does not run the agent. |
MCP (forgetrail-mcp) | Cursor or Claude | Methodology tools. Tracking still lives in the app repo. |
pnpm dlx forgetrail install --lite --with-genesis-stub
MCP: npx -y forgetrail-mcp with FORGETRAIL_ROOT set. Prefer pnpm dlx on Windows. Do not add forgetrail to an app's dependencies. Do not merge the two packages.
A 7-phase playbook, a live .forgetrail/workflow_tracking.json, and templates pre-loaded with first-party production lessons. Each project leaves a trail of decisions, gotchas, and breadcrumbs that future work follows. Those lesson notes are not independent adoption evidence. Flags, MCP, and the phase table live in the docs.
pnpm --dir mcp-server install
pnpm run mcp:build
pnpm site:dev
Site (FilePress + docs mount): pnpm ship.
Apache-2.0 · Catalyst Forge LLC
FAQs
ForgeTrail: a persistent development system for building software with AI agents. CLI, Lite protocol, and methodology templates.
The npm package forgetrail receives a total of 340 weekly downloads. As such, forgetrail popularity was classified as not popular.
We found that forgetrail demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.