registry / @polymorphism-tech/morph-spec / 7.9.0

@polymorphism-tech/morph-spec@7.9.0

MORPH-SPEC: NLH (Natural Language Harness) for spec-driven development with Claude Code

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 144 file(s), 884 KB of source, external domains: cli.github.com, cloud.google.com, contrast-ratio.com, json.schemastore.org, raw.githubusercontent.com, registry.npmjs.org, stitch.googleapis.com, www.python.org

Source & flagged code

8 flagged

package.jsonView file

Lines 38-78json

38 "type": "module",

39 "engines": {

40 "node": ">=22.0.0"

41 },

42 "scripts": {

43 "start": "node bin/morph-spec.js",

44 "generate": "node scripts/generate-refs.js",

45 "generate:check": "node scripts/generate-refs.js --check",

46 "generate-standards": "node scripts/generate-standards-registry.js",

47 "generate-standards:check": "node scripts/generate-standards-registry.js --check",

48 "validate": "node scripts/validate-framework.js",

49 "freshness": "node scripts/check-freshness.js",

50 "verify": "npm run generate:check && npm run generate-standards:check && npm run validate && npm run freshness && npm test",

51 "test": "node scripts/run-tests.mjs",

52 "test:coverage": "c8 --reporter=text --reporter=html --reporter=lcov node scripts/run-tests.mjs",

53 "test:coverage:summary": "c8 --reporter=text-summary node scripts/run-tests.mjs",

54 "docs": "jsdoc -c jsdoc.json",

55 "docs:watch": "jsdoc -c jsdoc.json --watch",

56 "docs:serve": "npx http-server docs/api -p 8080 -o",

57 "release": "node scripts/release.js",

58 "postinstall": "node src/scripts/global-install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L58

59 },

60 "dependencies": {

61 "chalk": "^5.3.0",

62 "commander": "^12.0.0",

63 "fs-extra": "^11.2.0",

64 "glob": "^13.0.6",

65 "handlebars": "^4.7.8",

66 "inquirer": "^9.2.0",

67 "minimatch": "^9.0.5",

68 "ora": "^8.0.0"

69 },

70 "repository": {

71 "type": "git",

72 "url": "git+https://github.com/lucasPolymorphism/morph-spec-framework.git"

73 },

74 "author": "Polymorphism Tech <contact@polymorphism.com.br>",

75 "license": "SEE LICENSE IN LICENSE",

76 "homepage": "https://polymorphism.com.br/morph-spec",

77 "bugs": {

78 "email": "support@polymorphism.com.br"

framework/hooks/claude-code/core/post-edit-typecheck.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

3/**

4 * PostToolUse Hook: TypeScript typecheck with debounce

5 *

6 * Event: PostToolUse | Matcher: Write|Edit

7 *

8 * Runs `npx tsc --noEmit` only for .ts/.tsx files, with a 3-second debounce

9 * so rapid sequential edits (e.g. multiple files in one task) don't each

10 * trigger a full typecheck. Silent on success — only injects on error.

11 *

src/scripts/global-install.jsView file

Lines 1-34javascript

1// src/scripts/global-install.js

2import { join, dirname } from 'path';

3import { fileURLToPath } from 'url';

4import { homedir, platform } from 'os';

5import { mkdir, readFile, writeFile } from 'fs/promises';

6import { existsSync } from

src/lib/installers/mcp-installer.jsView file

Lines 169-209javascript

169 } catch {

170 results.push({ name, repo: companion.repo, success: false });

171 }

172 }

173

174 return results;

175}

176

177/**

178 * Generate the Stitch OAuth proxy template script.

179

src/utils/hooks-installer.jsView file

Lines 1-34javascript

1/**

2 * Claude Code Hooks Installer (v2)

3 *

4 * Registry-based installer for all MORPH-SPEC Claude Code hooks.

5 * Declarative MORPH_HOOKS array defines all hooks.

6 * Idempotent merge into .claude/settings.local.json.

7 *

8 * Called by `morph-spec init` and `morph-spec update`.

9 */

11import { join, dirname } from 'path';

framework/hooks/claude-code/statusline.pyView file

•path = framework/hooks/claude-code/statusline.py kind = build_helper sizeBytes = 25708 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

framework/hooks/claude-code/statusline.pyView on unpkg

framework/templates/meta-prompts/validators/pre-commit-validator.mdView file

Lines 14-54markdown

15## Validation Sequence

17### 1. Conventional Commit Format Check

18Verify the commit message (if provided) follows Conventional Commits:

19```

20<type>(<scope>): <description>

22Types: feat, fix, docs, style, refactor, test, chore, perf, ci, build

23```

25Valid examples:

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/scripts/global-install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

framework/hooks/claude-code/core/post-edit-typecheck.jsView file

16L17: import { execSync } from 'child_process'; L18: import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'fs';

High

Child Process

Package source references child process execution.

framework/hooks/claude-code/core/post-edit-typecheck.jsView on unpkg · L16

7* L8: * Runs `npx tsc --noEmit` only for .ts/.tsx files, with a 3-second debounce L9: * so rapid sequential edits (e.g. multiple files in one task) don't each ... L16: L17: import { execSync } from 'child_process'; L18: import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

framework/hooks/claude-code/core/post-edit-typecheck.jsView on unpkg · L7

src/scripts/global-install.jsView file

14* Ensure the npm global bin directory is in the user's PATH on Windows. L15: * Adds it to the PowerShell $PROFILE so new terminals find `morph-spec`. L16: */

High

Shell

Package source references shell execution.

src/scripts/global-install.jsView on unpkg · L14

src/lib/installers/mcp-installer.jsView file

189*/ L190: const { execSync } = require('child_process'); L191: const { createInterface } = require('readline'); L192: L193: const STITCH_URL = 'https://stitch.googleapis.com/mcp'; L194: const PROJECT_ID = '${gcpProject}'; ... L197: const GCLOUD = process.platform === 'win32' L198: ? (process.env.LOCALAPPDATA || '') + '/Google/Cloud SDK/google-cloud-sdk/bin/gcloud.cmd' L199: : 'gcloud';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/lib/installers/mcp-installer.jsView on unpkg · L189

src/utils/hooks-installer.jsView file

14import { homedir } from 'os'; L15: import { execSync } from 'child_process'; L16: ... L212: try { L213: settings = JSON.parse(await readFile(settingsPath, 'utf-8')); L214: } catch { ... L289: // JSON Schema for IDE auto-complete and validation L290: settings['$schema'] = 'https://json.schemastore.org/claude-code-settings.json'; L291: ... L332: function findPython() { L333: if (process.platform !== 'win32') { L334: for (const cmd of ['python3', 'python']) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/utils/hooks-installer.jsView on unpkg · L14

framework/hooks/claude-code/statusline.pyView file

•path = framework/hooks/claude-code/statusline.py kind = build_helper sizeBytes = 25708 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

framework/hooks/claude-code/statusline.pyView on unpkg

framework/templates/meta-prompts/validators/pre-commit-validator.mdView file

34patternName = private_key_rsa severity = critical line = 34 matchedText = - Privat...---)

Critical

Secret Pattern

RSA private key in framework/templates/meta-prompts/validators/pre-commit-validator.md

framework/templates/meta-prompts/validators/pre-commit-validator.mdView on unpkg · L34

Findings

1 Critical6 High4 Medium5 Low

CriticalSecret Patternframework/templates/meta-prompts/validators/pre-commit-validator.md

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processframework/hooks/claude-code/core/post-edit-typecheck.js

HighShellsrc/scripts/global-install.js

HighSame File Env Network Executionsrc/lib/installers/mcp-installer.js

HighSandbox Evasion Gated Capabilitysrc/utils/hooks-installer.js

HighRuntime Package Installframework/hooks/claude-code/core/post-edit-typecheck.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperframework/hooks/claude-code/statusline.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

package.jsonView file

Lines 38-78json

38 "type": "module",

39 "engines": {

40 "node": ">=22.0.0"

41 },

42 "scripts": {

43 "start": "node bin/morph-spec.js",

44 "generate": "node scripts/generate-refs.js",

45 "generate:check": "node scripts/generate-refs.js --check",

46 "generate-standards": "node scripts/generate-standards-registry.js",

47 "generate-standards:check": "node scripts/generate-standards-registry.js --check",

48 "validate": "node scripts/validate-framework.js",

49 "freshness": "node scripts/check-freshness.js",

50 "verify": "npm run generate:check && npm run generate-standards:check && npm run validate && npm run freshness && npm test",

51 "test": "node scripts/run-tests.mjs",

52 "test:coverage": "c8 --reporter=text --reporter=html --reporter=lcov node scripts/run-tests.mjs",

53 "test:coverage:summary": "c8 --reporter=text-summary node scripts/run-tests.mjs",

54 "docs": "jsdoc -c jsdoc.json",

55 "docs:watch": "jsdoc -c jsdoc.json --watch",

56 "docs:serve": "npx http-server docs/api -p 8080 -o",

57 "release": "node scripts/release.js",

58 "postinstall": "node src/scripts/global-install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L58

59 },

60 "dependencies": {

61 "chalk": "^5.3.0",

62 "commander": "^12.0.0",

63 "fs-extra": "^11.2.0",

64 "glob": "^13.0.6",

65 "handlebars": "^4.7.8",

66 "inquirer": "^9.2.0",

67 "minimatch": "^9.0.5",

68 "ora": "^8.0.0"

69 },

70 "repository": {

71 "type": "git",

72 "url": "git+https://github.com/lucasPolymorphism/morph-spec-framework.git"

73 },

74 "author": "Polymorphism Tech <contact@polymorphism.com.br>",

75 "license": "SEE LICENSE IN LICENSE",

76 "homepage": "https://polymorphism.com.br/morph-spec",

77 "bugs": {

78 "email": "support@polymorphism.com.br"

framework/hooks/claude-code/core/post-edit-typecheck.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

3/**

4 * PostToolUse Hook: TypeScript typecheck with debounce

5 *

6 * Event: PostToolUse | Matcher: Write|Edit

7 *

8 * Runs `npx tsc --noEmit` only for .ts/.tsx files, with a 3-second debounce

9 * so rapid sequential edits (e.g. multiple files in one task) don't each

10 * trigger a full typecheck. Silent on success — only injects on error.

11 *

src/scripts/global-install.jsView file

Lines 1-34javascript

1// src/scripts/global-install.js

2import { join, dirname } from 'path';

3import { fileURLToPath } from 'url';

4import { homedir, platform } from 'os';

5import { mkdir, readFile, writeFile } from 'fs/promises';

6import { existsSync } from

src/lib/installers/mcp-installer.jsView file

Lines 169-209javascript

169 } catch {

170 results.push({ name, repo: companion.repo, success: false });

171 }

172 }

173

174 return results;

175}

176

177/**

178 * Generate the Stitch OAuth proxy template script.

179

src/utils/hooks-installer.jsView file

Lines 1-34javascript

1/**

2 * Claude Code Hooks Installer (v2)

3 *

4 * Registry-based installer for all MORPH-SPEC Claude Code hooks.

5 * Declarative MORPH_HOOKS array defines all hooks.

6 * Idempotent merge into .claude/settings.local.json.

7 *

8 * Called by `morph-spec init` and `morph-spec update`.

9 */

11import { join, dirname } from 'path';

framework/hooks/claude-code/statusline.pyView file

•path = framework/hooks/claude-code/statusline.py kind = build_helper sizeBytes = 25708 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

framework/hooks/claude-code/statusline.pyView on unpkg

framework/templates/meta-prompts/validators/pre-commit-validator.mdView file

Lines 14-54markdown

15## Validation Sequence

17### 1. Conventional Commit Format Check

18Verify the commit message (if provided) follows Conventional Commits:

19```

20<type>(<scope>): <description>

22Types: feat, fix, docs, style, refactor, test, chore, perf, ci, build

23```

25Valid examples: