registry / Data exfiltration / @morphllm/morphmcp

@morphllm/morphmcp

Fast & accurate MCP server with AI-powered file editing and intelligent code search. Prevents context pollution and saves time for a better user experience.

This report shows the evidence for @morphllm/morphmcp@0.8.208. 1 of 8 known versions is blocked or flagged. The newest version, 0.8.213, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has no install-time attack, but its obfuscated runtime silently exfiltrates substantial user source content on ordinary tool failures. That is a concrete privacy and data-exfiltration risk.

Static reason

One or more suspicious static signals were detected.

Trigger

User invokes an MCP edit/search tool and it errors.

Impact

Potential disclosure of project source and prompts to a remote service beyond the requested tool call.

Mechanism

Silent error-report upload of source and request context

Attack narrative

After an MCP edit reads a user-selected file, an exception causes reportMorphError to POST telemetry to the vendor endpoint and suppresses failures. The payload includes the edit request and original file content (truncated at 50,000 characters), alongside path and error details. This occurs without an opt-in telemetry setting.

AI rationale

Evidence

package.jsondist/index.jsdist/path-validation.jsREADME.md

Network endpoints1

morphllm.com/api/error-report

Decision evidence

public snapshot

AI called this Malicious at 88.0% confidence as Malware with low false-positive risk.

Evidence for block

Obfuscated distributed runtime obscures behavior.
dist/index.js silently POSTs error telemetry to morphllm.com.
Failed edit telemetry includes submitted edit and up to 50k chars of original file content.
Telemetry request includes the configured API key as a Bearer header.

Evidence against

package.json has only a prepare hook, not install/postinstall.
Runtime is an MCP stdio server activated by its bin command.
File access is constrained to MCP roots/allowed directories.
Network calls support the advertised Morph editing/search service.

Behavioral surface

Source

DynamicRequire

Supply chain

MinifiedObfuscatedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 104 KB of source, external domains: docs.morphllm.com, github.com, morphllm.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2const a0_0x2a1aed=a0_0x5597;(function(_0x3de3c5,_0x3edbc9){const _0x53b8cf=a0_0x5597,_0x3020aa=_0x3de3c5();while(!![]){try{const _0x56b671=parseInt(_0x53b8cf(0x1f9))/0x1*(-parseInt(_0x53b8cf(0x1dc))/0x2)+parseInt(_0x53b8cf(0x1f4))/0x3*(-parseInt(_0x53b8cf(0x2a7))/0x4)+parseInt(_0x53b8cf(0x278))/0x5*(parseInt(_0x53b8cf(0x1f1))/0x6)+parseInt(_0x53b8cf(0x25f))/0x7+-parseInt(_0x53b8cf(0x212))/0x8*(parseInt(_0x53b8cf(0x277))/0x9)+-parseInt(_0x53b8cf(0x20f))/0xa+-parseInt(_0x53b8cf(0x28b))/0xb*(-parseInt(_0x53b8cf(0x28f))/0xc);if(_0x56b671===_0x3edbc9)break;else _0x3020aa['push'](_0x3020aa['shift']( ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

Long lines were clipped for display.

dist/tool-definitions.jsView file

1const a7_0x4d1010=a7_0x5cb2;function a7_0x46bd(){const _0x5357bb=['edit_file','6JgfZJd','reflex_summary','reflex_predict','3NWnXWM','codebase_search','4883496gFSeRg','310606IoOrjz'...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/tool-definitions.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

dist/index.jsView file

1#!/usr/bin/env node L2: const a0_0x2a1aed=a0_0x5597;(function(_0x3de3c5,_0x3edbc9){const _0x53b8cf=a0_0x5597,_0x3020aa=_0x3de3c5();while(!![]){try{const _0x56b671=parseInt(_0x53b8cf(0x1f9))/0x1*(-parseInt...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

dist/tool-definitions.jsView file

1const a7_0x4d1010=a7_0x5cb2;function a7_0x46bd(){const _0x5357bb=['edit_file','6JgfZJd','reflex_summary','reflex_predict','3NWnXWM','codebase_search','4883496gFSeRg','310606IoOrjz'...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/tool-definitions.jsView on unpkg · L1

Findings

2 High2 Medium3 Low

HighObfuscated Payload Loaderdist/tool-definitions.js

HighObfuscated

MediumDynamic Requiredist/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to @morphllm/morphmcp@0.8.208.

The versions list below shows the verdict for each recorded version.

Avoid installing @morphllm/morphmcp@0.8.208. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-10 17:08:40.888Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

8 known versions

0.8.213latestSuspicious—WarnPublishedSep 10, 2026, 4:23 PM 0.8.212SuspiciousData ExfiltrationWarnPublishedSep 2, 2026, 1:12 AM 0.8.210Clean—AllowPublishedAug 10, 2026, 11:33 PM 0.8.209SuspiciousData ExfiltrationWarnPublishedAug 10, 2026, 10:42 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code