registry / @polymorphism-tech/morph-spec / 8.1.2

@polymorphism-tech/morph-spec@8.1.2

MORPH-SPEC: NLH (Natural Language Harness) for spec-driven development with Claude Code

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 22 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 149 file(s), 990 KB of source, external domains: cli.github.com, cloud.google.com, contrast-ratio.com, json.schemastore.org, raw.githubusercontent.com, registry.npmjs.org, stitch.googleapis.com, www.python.org

Source & flagged code

13 flagged

package.jsonView file

Lines 39-79json

39 "engines": {

40 "node": ">=22.0.0"

41 },

42 "scripts": {

43 "start": "node bin/morph-spec.js",

44 "generate": "node scripts/generate-refs.js",

45 "generate:check": "node scripts/generate-refs.js --check",

46 "generate-standards": "node scripts/generate-standards-registry.js",

47 "generate-standards:check": "node scripts/generate-standards-registry.js --check",

48 "validate": "node scripts/validate-framework.js",

49 "freshness": "node scripts/check-freshness.js",

50 "verify": "npm run generate:check && npm run generate-standards:check && npm run validate && npm run freshness && npm test",

51 "test": "node scripts/run-tests.mjs",

52 "test:coverage": "c8 --reporter=text --reporter=html --reporter=lcov node scripts/run-tests.mjs",

53 "test:coverage:summary": "c8 --reporter=text-summary node scripts/run-tests.mjs",

54 "docs": "jsdoc -c jsdoc.json",

55 "docs:watch": "jsdoc -c jsdoc.json --watch",

56 "docs:serve": "npx http-server docs/api -p 8080 -o",

57 "release": "node scripts/release.js",

58 "prepublishOnly": "node scripts/prepublish-check.js",

59 "postinstall": "node src/scripts/global-install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

60 },

61 "dependencies": {

62 "chalk": "^5.3.0",

63 "commander": "^12.0.0",

64 "fs-extra": "^11.2.0",

65 "glob": "^13.0.6",

66 "handlebars": "^4.7.8",

67 "inquirer": "^9.2.0",

68 "minimatch": "^9.0.5",

69 "ora": "^8.0.0"

70 },

71 "repository": {

72 "type": "git",

73 "url": "git+https://github.com/lucasPolymorphism/morph-spec-framework.git"

74 },

75 "author": "Polymorphism Tech <contact@polymorphism.com.br>",

76 "license": "SEE LICENSE IN LICENSE",

77 "homepage": "https://polymorphism.com.br/morph-spec",

78 "bugs": {

79 "email": "support@polymorphism.com.br"

framework/hooks/claude-code/core/post-edit-typecheck.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

3/**

4 * PostToolUse Hook: TypeScript typecheck with debounce

5 *

6 * Event: PostToolUse | Matcher: Write|Edit

7 *

8 * Runs `npx tsc --noEmit` only for .ts/.tsx files, with a 3-second debounce

9 * so rapid sequential edits (e.g. multiple files in one task) don't each

10 * trigger a full typecheck. Silent on success — only injects on error.

src/scripts/global-install.jsView file

Lines 1-34javascript

1// src/scripts/global-install.js

2import { join, dirname } from 'path';

3import { fileURLToPath } from 'url';

4import { homedir, platform } from 'os';

5import { mkdir, readFile, writeFile } from

src/lib/installers/mcp-installer.jsView file

Lines 169-209javascript

169 } catch {

170 results.push({ name, repo: companion.repo, success: false });

171 }

172 }

173

174 return results;

175}

176

177/**

src/utils/hooks-installer.jsView file

Lines 1-34javascript

1/**

2 * Claude Code Hooks Installer (v2)

3 *

4 * Registry-based installer for all MORPH-SPEC Claude Code hooks.

5 * Declarative MORPH_HOOKS array defines all hooks.

6 * Idempotent merge into .claude/settings.local.json.

7 *

8 * Called by `morph-spec init` and `morph-spec update`.

9 */

11import { join, dirname }

framework/hooks/claude-code/statusline.pyView file

•path = framework/hooks/claude-code/statusline.py kind = build_helper sizeBytes = 25029 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

framework/hooks/claude-code/statusline.pyView on unpkg

src/commands/dashboard/dashboard.jsView file

•matchType = normalized_sha256 matchedPackage = @polymorphism-tech/morph-spec@7.8.0 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:7.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/dashboard/dashboard.jsView on unpkg

framework/templates/project/validate.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

framework/templates/project/validate.jsView on unpkg

src/commands/mcp/mcp-setup.jsView file

•matchType = normalized_sha256 matchedPackage = @polymorphism-tech/morph-spec@7.8.0 matchedPath = src/commands/mcp/mcp-setup.js matchedIdentity = npm:[redacted]:7.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/mcp/mcp-setup.jsView on unpkg

src/lib/generators/architecture-scanner.jsView file

•matchType = normalized_sha256 matchedPackage = @polymorphism-tech/morph-spec@7.8.0 matchedPath = src/lib/generators/architecture-scanner.js matchedIdentity = npm:[redacted]:7.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/lib/generators/architecture-scanner.jsView on unpkg

framework/templates/meta-prompts/validators/pre-commit-validator.mdView file

Lines 14-54markdown

15## Validation Sequence

17### 1. Conventional Commit Format Check

18Verify the commit message (if provided) follows Conventional Commits:

19```

20<type>(<scope>): <description>

22Types: feat, fix, docs, style, refactor, test, chore, perf, ci, build

23```

Source & flagged code

13 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code