I built a Cargo supply chain auditor using Claude and GitHub Actions
Tarball diffing plus Claude analysis catches build.rs backdoors cargo-audit misses.
yoink is an AI agent that removes complex dependencies by reimplementing only what you need.
Reimplements dependency functions locally with test verification, challenging the "dependencies are good" mantra.
Backend developers concerned about supply chain security
Cursor · Snyk · Codemod
yoink runs as a three-step, agent skills-based workflow:
1. /setup clones the target repo and scaffolds a replacement package.
2. /curate-tests generates tests verified against the original's expectations.
3. /decompose determines dependencies to keep or decompose based on principles such as "keeping foundational primitives regardless of how narrow they are used".
We built yoink in response to the five major supply chain attacks that happened in two weeks, including LiteLLM and axios. We install most of these packages without thinking twice.
Andrej Karpathy recently called for re-evaluating the belief that "dependencies are good". OpenAI echoed this in their harness engineering article: agents reason better from reimplemented functionality they have full visibility into, over opaque third-party libraries.
yoink makes this capability accessible to anyone.
Refer to the GitHub repo to install the plugin to Claude Code: https://github.com/theogbrand/yoink
Love to hear what you think!
Tarball diffing plus Claude analysis catches build.rs backdoors cargo-audit misses.
Speculative protocol for package quarantine without a reference implementation or registry buy-in.
Catches .pth injection vectors from the litellm attack when Snyk and Dependabot miss them.
Forensic triage CLI with verdict system for axios IOC detection.
Deterministic dependency review with cross-stack scanning, but Dependabot, Snyk, and Renovate dominate CI dependency automation.
Dependabot already does this without the AI agent overhead.