Yank Trace
A CLI that takes a list of malicious package versions and tells you which CI runs installed them and which secrets those runs could read, so the rotation list is evidence instead of a guess.
Yank Trace
A CLI that takes a list of malicious package versions and tells you which CI runs installed them and which secrets those runs could read, so the rotation list is evidence instead of a guess.
Problem
When a worm like ChainDrop lands, the advisory says "identify installs of affected versions, rotate credentials." The registry has often pulled the package by the time you look, so you can't just re-download it and inspect. A 12 October 2026 briefing makes the same point about a pulled npm package: lockfiles, caches, SBOMs and old CI logs are the only evidence left. Most teams end up rotating every secret in the org because they can't say which jobs ran the bad version.
Target user
A platform or security engineer at a company with a few dozen repos on GitHub Actions who gets paged when an advisory drops. Today they grep lockfiles in HEAD, which misses a version that was installed for 40 minutes on a feature branch and then bumped away. They need the history, joined to what each job could access.
MVP scope
- Input: a text file of package@version entries (npm and PyPI) from an advisory or from
npm auditstyle feeds. - Walk git history for lockfiles (package-lock.json, pnpm-lock.yaml, poetry.lock) across all branches and report every commit and branch where a listed version appeared.
- Pull GitHub Actions run history through the API for the windows those commits were live, and flag runs that executed an install step on that ref.
- For each flagged run, read the workflow file at that commit and list the secrets, environment references and OIDC permissions the job had. Note whether it ran from a fork or a protected environment.
- Output a rotation list grouped by credential, each line citing run ID, date and workflow file, plus a list of runs it could not check because logs had expired.
- Fully local except for the GitHub API; no code or secrets leave the machine.
Monetization
Freemium. The CLI is free for public repos and one org. A paid tier at roughly $29/month per org adds GitLab and CircleCI support, scheduled re-scans against new advisories, and an export for the incident report. This is a judgment call on price, not a tested number.
Why now
The ChainDrop and Shai-Hulud advisories (published 6 August 2026, with Singapore's CSA entry updated as recently as 13 November 2026) cover 1,300+ compromised package versions and tell victims to rotate cloud, GitHub, SSH and Terraform credentials. Unit 42 says the payload reads runner memory for OIDC tokens and runner secrets on GitHub Actions, so exposure depends on what each job could see, not only on whether the package was present. Advisories keep naming that scope question without giving tooling to answer it.
Risks & open questions
- Demand: teams under pressure may prefer to rotate everything and skip the analysis. The tool only pays off for orgs where mass rotation is expensive, such as shared cloud roles or customer-facing signing keys.
- Demand: free scanners and vendor incident features may add install-history lookups. I have not checked what Dependabot, Socket or Snyk already offer here.
- Build: GitHub keeps Actions logs for 90 days by default, so older runs can only be inferred from commit history. The report has to separate "confirmed install" from "possible install."
- Build: working out what a job could read means parsing workflow YAML, reusable workflows and environment secrets. Org-level secrets and reusable workflows pulled from other repos are the hard part for a solo build.
- Install detection from lockfile commits is approximate. A job can resolve a version without a lockfile entry, for example
npm installwith no lockfile.
Next step
Run a one-day spike against a single repo with a known past lockfile change, and check whether the output matches what a human would write for a rotation list.
Sources
- https://csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009 — CSA advisory (6 August 2026, updated 13 November 2026) on ChainDrop: 1,300+ package versions, rotate-credentials guidance, remove affected versions from CI.
- https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ — Unit 42 analysis (6 August 2026): payload reads GitHub Actions runner memory for OIDC tokens and secrets, plants a workflow serializing repository secrets.
- https://corgea.com/research/weekly-briefing-15-10-2026/ — briefing of 15 October 2026 on a pulled npm package where lockfiles, caches and CI logs are the remaining evidence.
