registry / @morphllm/morphmcp / 0.8.208

@morphllm/morphmcp

@0.8.208

Fast & accurate MCP server with AI-powered file editing and intelligent code search. Prevents context pollution and saves time for a better user experience.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

On an edit or search failure, the MCP server silently sends detailed error telemetry to Morph. For edit failures this includes the selected source file's content, edit request, path, and stack trace.

Static reason

One or more suspicious static signals were detected.

Trigger

User invokes an MCP edit/search tool and it errors.

Impact

Potential disclosure of project source and prompts to a remote service beyond the requested tool call.

Mechanism

Silent error-report upload of source and request context

Attack narrative

After an MCP edit reads a user-selected file, an exception causes reportMorphError to POST telemetry to the vendor endpoint and suppresses failures. The payload includes the edit request and original file content (truncated at 50,000 characters), alongside path and error details. This occurs without an opt-in telemetry setting.

Rationale

The package has no install-time attack, but its obfuscated runtime silently exfiltrates substantial user source content on ordinary tool failures. That is a concrete privacy and data-exfiltration risk.

Evidence

package.jsondist/index.jsdist/path-validation.jsREADME.md

Network endpoints1

morphllm.com/api/error-report

Decision evidence

public snapshot

AI called this Malicious at 88.0% confidence as Malware with low false-positive risk.

Evidence for block

Obfuscated distributed runtime obscures behavior.
dist/index.js silently POSTs error telemetry to morphllm.com.
Failed edit telemetry includes submitted edit and up to 50k chars of original file content.
Telemetry request includes the configured API key as a Bearer header.

Evidence against

package.json has only a prepare hook, not install/postinstall.
Runtime is an MCP stdio server activated by its bin command.
File access is constrained to MCP roots/allowed directories.
Network calls support the advertised Morph editing/search service.

Behavioral surface

Source

DynamicRequire

Supply chain

MinifiedObfuscatedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 104 KB of source, external domains: docs.morphllm.com, github.com, morphllm.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2const a0_0x2a1aed=a0_0x5597;(function(_0x3de3c5,_0x3edbc9){const _0x53b8cf=a0_0x5597,_0x3020aa=_0x3de3c5();while(!![]){try{const _0x56b671=parseInt(_0x53b8cf(0x1f9))/0x1*(-parseInt(_0x53b8cf(0x1dc))/0x2)+parseInt(_0x53b8cf(0x1f4))/0x3*(-parseInt(_0x53b8cf(0x2a7))/0x4)+parseInt(_0x53b8cf(0x278))/0x5*(parseInt(_0x53b8cf(0x1f1))/0x6)+parseInt(_0x53b8cf(0x25f))/0x7+-parseInt(_0x53b8cf(0x212))/0x8*(parseInt(_0x53b8cf(0x277))/0x9)+-parseInt(_0x53b8cf(0x20f))/0xa+-parseInt(_0x53b8cf(0x28b))/0xb*(-parseInt(_0x53b8cf(0x28f))/0xc);if(_0x56b671===_0x3edbc9)break;else _0x3020aa['push'](_0x3020aa['shift']( ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

Long lines were clipped for display.

dist/tool-definitions.jsView file

Lines 1-1javascript

1const a7_0x4d1010=a7_0x5cb2;function a7_0x46bd(){const _0x5357bb=['edit_file','6JgfZJd','reflex_summary','reflex_predict','3NWnXWM','codebase_search','4883496gFSeRg',

Source & flagged code

2 flagged · loading source

dist/index.jsView file

1#!/usr/bin/env node L2: const a0_0x2a1aed=a0_0x5597;(function(_0x3de3c5,_0x3edbc9){const _0x53b8cf=a0_0x5597,_0x3020aa=_0x3de3c5();while(!![]){try{const _0x56b671=parseInt(_0x53b8cf(0x1f9))/0x1*(-parseInt...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

dist/tool-definitions.jsView file

1const a7_0x4d1010=a7_0x5cb2;function a7_0x46bd(){const _0x5357bb=['edit_file','6JgfZJd','reflex_summary','reflex_predict','3NWnXWM','codebase_search','4883496gFSeRg','310606IoOrjz'...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/tool-definitions.jsView on unpkg · L1

Findings

2 High2 Medium3 Low

HighObfuscated Payload Loaderdist/tool-definitions.js

HighObfuscated

MediumDynamic Requiredist/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

LPM CLI

Install lifecycle

prepare

Behavioral surface

DynamicRequireMinifiedObfuscatedTrivialUrlStringsManifest: clean

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2const a0_0x2a1aed=a0_0x5597;(function(_0x3de3c5,_0x3edbc9){const _0x53b8cf=a0_0x5597,_0x3020aa=_0x3de3c5();while(!![]){try{const _0x56b671=parseInt(_0x53b8cf(0x1f9))/0x1*(-parseInt(_0x53b8cf(0x1dc))/0x2)+parseInt(_0x53b8cf(0x1f4))/0x3*(-parseInt(_0x53b8cf(0x2a7))/0x4)+parseInt(_0x53b8cf(0x278))/0x5*(parseInt(_0x53b8cf(0x1f1))/0x6)+parseInt(_0x53b8cf(0x25f))/0x7+-parseInt(_0x53b8cf(0x212))/0x8*(parseInt(_0x53b8cf(0x277))/0x9)+-parseInt(_0x53b8cf(0x20f))/0xa+-parseInt(_0x53b8cf(0x28b))/0xb*(-parseInt(_0x53b8cf(0x28f))/0xc);if(_0x56b671===_0x3edbc9)break;else _0x3020aa['push'](_0x3020aa['shift']( ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

Long lines were clipped for display.

dist/tool-definitions.jsView file

Lines 1-1javascript

1const a7_0x4d1010=a7_0x5cb2;function a7_0x46bd(){const _0x5357bb=['edit_file','6JgfZJd','reflex_summary','reflex_predict','3NWnXWM','codebase_search','4883496gFSeRg',

'310606IoOrjz'

,

'github_codebase_search'

,

'reflex_list'

,

'4281350KPPBfz'

,

'677373Bjqrpl'

,

'1390459UAxIBI'

,

'values'

,

'2372085PhMrmh'

,

'2110788uVixEZ'

,

'4cgAAxm'

];

a7_0x46bd

=function

(){

return

_0x5357bb;};

return

a7_0x46bd

();}(

function

(

_0xcc1e7e

,

_0x594144

){

const

_0x349a1b

=

a7_0x5cb2,

_0x4f2bce

=

_0xcc1e7e

();

while

(

!!

[]){

try

{

const

_0x194a7f

=-

parseInt

(

_0x349a1b

(

0xb3

))

/

0x1

*

(

parseInt

(

_0x349a1b

(

0xa5

))

/

0x2

)

+

parseInt

(

_0x349a1b

(

0xa9

))

/

0x3

*

(

parseInt

(_0x349a

...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/tool-definitions.jsView on unpkg · L1

Long lines were clipped for display.