Intro

A week ago, an attempt to install neural-trader on Apple Silicon led to a 120 GB RAM fork-bomb. The fix for that (#1974) was shipped quickly, but it only addressed the most dramatic symptom. A deeper audit found three more bugs that had been silently making the package unusable as a library on every platform since v2.5.0 (November 2025) — including missing source files that were caught by a stray Python-template .gitignore rule, an x86-only hashing library that blocked builds on Apple Silicon, and a release pipeline that claimed to ship binaries for five platforms but actually shipped one.

All of those are fixed in neural-trader@2.7.6, on npm now. This issue is the announcement, with what changed, who's affected, and what to do.

What's fixed in 2.7.6

Platform coverage in 2.7.6

What to do

If you're using neural-trader directly:

npm install --ignore-scripts neural-trader@2.7.6

(The --ignore-scripts flag is kept as belt-and-braces defense in depth — the install hook is safe in 2.7.2+, but skipping it costs nothing.)

Verify:

node -e "console.log(Object.keys(require('neural-trader')).length)"
# Expected: 194

If you're using the ruflo-neural-trader plugin in this repo, it'll be bumped to require neural-trader@^2.7.6 in a follow-up PR — the CI guard scripts/audit-neural-trader-safety.mjs still enforces --ignore-scripts on every documented invocation as defense in depth.

Want the full story?

The full technical post-mortem with root-cause analysis for each bug is at:

📄 https://gist.github.com/ruvnet/a1aca90a5c299d89fa92e905dab11041

It covers:

• How the install hook ended up calling itself recursively
• Why a Python .gitignore template made three load-bearing JS files invisible to git
• Why one placeholder hash call brought down the entire ARM-darwin build
• All 8 separate CI workflow bugs and how each was fixed
• Build-from-source verification on Apple Silicon

References

• Original bug report: #1974
• Upstream PRs: #109, #111, #112
• Post-mortem gist: https://gist.github.com/ruvnet/a1aca90a5c299d89fa92e905dab11041
• npm: https://www.npmjs.com/package/neural-trader (latest = 2.7.6)

Closing this issue when the ruflo-neural-trader plugin's prerequisite pin is bumped to ^2.7.6.