Loading npm security reports…

@polymorphism-tech/morph-spec@8.40.0: AI-agent control-surface | LPM Firewall

registry / @polymorphism-tech/morph-spec / 8.40.0

@polymorphism-tech/morph-spec@8.40.0

MORPH-SPEC: NLH (Natural Language Harness) for spec-driven development with Claude Code

AI Security Review

scanned 13d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall writes the user-global Claude Code control file ~/.claude/settings.json and installs a statusLine command that Claude runs for every session, not only morph-spec projects. On Windows it also edits the user PowerShell profile.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Automatic npm postinstall of @polymorphism-tech/morph-spec.

Impact

Any later Claude Code session executes the package statusline command and the user agent settings are changed without a separate consent step.

Mechanism

global-install.js calls installGlobalStatusline, which copies statusline.sh and statusline.py into ~/.claude and shallow-merges a statusLine command into ~/.claude/settings.json. Windows installs also append a PATH block to the PowerShell profile.

Policy narrative

Installing the package runs postinstall, which calls installGlobalStatusline. That function copies the package statusline scripts into the user-wide ~/.claude directory and merges a statusLine command into ~/.claude/settings.json so Claude Code runs it in every session. The same install path on Windows also rewrites the PowerShell profile. The user does not invoke a setup command for this write.

AI rationale

The postinstall hook unconditionally mutates the user-global Claude Code settings file and installs a command Claude executes for every session. That is an unconsented install-time change of a broad agent control surface.

Evidence

package.jsonsrc/scripts/global-install.jssrc/utils/hooks-installer.jssrc/lib/installers/effects.js~/.claude/settings.json

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/scripts/global-install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

framework/hooks/claude-code/core/post-edit-typecheck.jsView file

23L24: import { execSync } from 'child_process'; L25: import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'fs';

High

Child Process

Package source references child process execution.

framework/hooks/claude-code/core/post-edit-typecheck.jsView on unpkg · L23

108try { L109: execSync('npx tsc --noEmit', { cwd: root, stdio: 'pipe', timeout: TSC_TIMEOUT_MS }); L110: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

framework/hooks/claude-code/core/post-edit-typecheck.jsView on unpkg · L108

•matchType = normalized_sha256 matchedPackage = @polymorphism-tech/morph-spec@8.37.0 matchedPath = framework/hooks/claude-code/core/post-edit-typecheck.js matchedIdentity = npm:[redacted]:8.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

framework/hooks/claude-code/core/post-edit-typecheck.jsView on unpkg

framework/hooks/shared/morph-cli.jsView file

41L42: /** Quote one argument for cmd.exe (the only shell path this module uses). */ L43: export function quoteForCmd(arg) {

High

Shell

Package source references shell execution.

framework/hooks/shared/morph-cli.jsView on unpkg · L41

bin/morph-spec.jsView file

23// that breaks at import time still fails the suite, not only its own command. L24: const lazy = (path, name) => async (...args) => (await import(path))[name](...args); L25:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/morph-spec.jsView on unpkg · L23

framework/hooks/claude-code/core/validate-completion.jsView file

55recap = readFileSync(recapPath, 'utf-8'); L56: tasksJson = JSON.parse(readFileSync(tasksJsonPath, 'utf-8')); L57: } catch { ... L143: // Prevent infinite loop L144: if (process.env.MORPH_STOP_HOOK_ACTIVE === '1') return null; L145: ... L153: const { name, feature } = active; L154: const cwd = process.cwd(); L155: const warnings = [];

Low

Weak Crypto

Package source references weak cryptographic algorithms.

framework/hooks/claude-code/core/validate-completion.jsView on unpkg · L55

src/utils/hooks-installer.jsView file

14import { homedir } from 'os'; L15: import { execSync } from 'child_process'; L16: import { realEffects } from '../lib/installers/effects.js'; ... L183: // (measured: all three fire it). The hook prints the created path as its L184: // last stdout line; a non-zero exit fails the creation. No matcher exists L185: // for this event. 120s: it spawns the morph-spec CLI (setup or provision), ... L357: try { L358: settings = JSON.parse(await readFile(settingsPath, 'utf-8')); L359: } catch { ... L448: // JSON Schema for IDE auto-complete and validation L449: settings['$schema'] = 'https://json.schemastore.org/claude-code-settings.json'; L450:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/utils/hooks-installer.jsView on unpkg · L14

src/scripts/global-install.jsView file

48} else { L49: await mkdir(dirname(profilePath), { recursive: true }); L50: } ... L73: label: 'statusline', L74: path: '~/.claude/', L75: error: statuslineResult.reason?.message,

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/scripts/global-install.jsView on unpkg · L48

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: ll_profile.ps1'); const psprofilelegacy = join(homedir(), 'documents', 'windowspowershell', 'microsoft.powershell_profile.ps1'); const marker = '# morph-spec: ensure npm global in path'; const snippet = [ marker, `if ($env:path -notlike "*${npm[redacted](/\\/g, '\\\\')}*") {`, ` $env:path += ";${npmglobaldir}"`, '}', '# end morph-spec path', ].join('\n'); for (const profilepath of [psprofile, psprofilelegacy]) { try { let content = ''; if (existssync(profilepath)) { content = await readfile(profilepath, 'utf8'); if (content.includes(marker)) continue; } else { await mkdir(dirname(profilepath), { recursiv

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/scripts/global-install.jsView on unpkg

framework/hooks/claude-code/statusline.pyView file

•path = framework/hooks/claude-code/statusline.py kind = build_helper sizeBytes = 28396 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

framework/hooks/claude-code/statusline.pyView on unpkg

framework/hooks/claude-code/core/worktree-context.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

framework/hooks/claude-code/core/worktree-context.js#virtual:normalized:round1View on unpkg

framework/templates/project/validate.jsView file

•matchType = normalized_sha256 matchedPackage = @polymorphism-tech/morph-spec@8.37.0 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:8.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

framework/templates/project/validate.jsView on unpkg

src/commands/e2e/e2e.jsView file

•matchType = normalized_sha256 matchedPackage = @polymorphism-tech/morph-spec@8.37.0 matchedPath = src/commands/e2e/e2e.js matchedIdentity = npm:[redacted]:8.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/e2e/e2e.jsView on unpkg

src/lib/worktree/fleet-scanner.jsView file

•matchType = normalized_sha256 matchedPackage = @polymorphism-tech/morph-spec@8.37.0 matchedPath = src/lib/worktree/fleet-scanner.js matchedIdentity = npm:[redacted]:8.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/lib/worktree/fleet-scanner.jsView on unpkg

src/utils/version-checker.jsView file

•matchType = normalized_sha256 matchedPackage = @polymorphism-tech/morph-spec@8.37.0 matchedPath = src/utils/version-checker.js matchedIdentity = npm:[redacted]:8.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/version-checker.jsView on unpkg

src/commands/state/create.jsView file

•matchType = normalized_sha256 matchedPackage = @polymorphism-tech/morph-spec@8.37.0 matchedPath = src/commands/state/create.js matchedIdentity = npm:[redacted]:8.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/state/create.jsView on unpkg

src/lib/generators/architecture-scanner.jsView file

•matchType = normalized_sha256 matchedPackage = @polymorphism-tech/morph-spec@8.37.0 matchedPath = src/lib/generators/architecture-scanner.js matchedIdentity = npm:[redacted]:8.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/lib/generators/architecture-scanner.jsView on unpkg

src/lib/validators/ui/ui-contrast-validator.jsView file

•matchType = normalized_sha256 matchedPackage = @polymorphism-tech/morph-spec@8.37.0 matchedPath = src/lib/validators/ui/ui-contrast-validator.js matchedIdentity = npm:[redacted]:8.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/lib/validators/ui/ui-contrast-validator.jsView on unpkg