
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
weavatrix-refactor
Advanced tools
Transactional refactoring MCP for coding agents: evidence-backed plans, hash-bound previews, crash-recoverable writes, and rollback.
Transactional refactoring MCP for coding agents: 11 evidence-backed plan/apply tools, hash-bound previews, crash-recoverable writes, and rollback — plus the 43 read-only operations of the Weavatrix engine, in one process.
npx -y weavatrix-refactor mcp /absolute/path/to/repository
For rename-only sessions, keep the agent context small:
npx -y weavatrix-refactor mcp /absolute/path/to/repository --profile=rename
That profile exposes only rename_symbol and rollback_last_apply. The default
--profile=full surface remains available for discovery and other refactors.
This package ships the native Rust binary. Nothing is compiled at install time, there are no lifecycle scripts, and no runtime dependencies.
Producing a plan is a read. Applying one requires two enforced gates:
WEAVATRIX_ALLOW_SOURCE_EDITS=1 and a single-use token bound to that exact plan
and repository. Selecting this write-capable package or a narrower tool profile
does not grant write authority.
1.0 is the engine change. Versions 0.1.x were a JavaScript package. That package line continues as
weavatrix-refactor-js, which picks up the version line at 0.1.6 whereweavatrix-refactor@0.1.5left off. The two keep separate state directories, so they never share a lock, a token store, or a rollback journal.
Full documentation: github.com/sergii-ziborov/weavatrix-refactor
MIT.
FAQs
Transactional MCP refactoring extension: evidence-backed plans, hash-bound previews, crash-recoverable writes, and rollback.
The npm package weavatrix-refactor receives a total of 132 weekly downloads. As such, weavatrix-refactor popularity was classified as not popular.
We found that weavatrix-refactor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.