registry / merrymen / 0.4.1

merrymen@0.4.1

Self-hosted autonomous trading agents for Robinhood Chain — your keys, your caps, hard on-chain permission walls, write-your-own strategies.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 64 file(s), 390 KB of source, external domains: api.pimlico.io, api.telegram.org, blue-api.morpho.org, cdn.robinhood.com, docs.rialto.xyz, explorer.testnet.chain.robinhood.com, faucet.testnet.chain.robinhood.com, nodejs.org, rialto-trade-api.rialto.xyz, robinhoodchain.blockscout.com, rpc.mainnet.chain.robinhood.com, rpc.testnet.chain.robinhood.com, www.w3.org

Source & flagged code

3 flagged

worker/src/strategies/custom.tsView file

Lines 115-155typescript

115interface LoadedModule {

116 mtimeMs: number;

117 strategy: { name?: string; tick: (snap: Snapshot, ctx: StrategyCtx) => unknown } | null;

118 error?: string;

119}

120

121/**

122 * Wrap a user strategy file as a Strategy. Import happens inside tick so a

123 * bad file never breaks worker startup, and an edited file reloads on mtime.

124 */

125export function makeCustomStrategy(

126 name: string,

127 opts?: {

128 dir?: string;

129 onNote?: (level: "ok" | "warn", message: string) => void;

130 /** Injectable for tests. */

131 importer?: (fileUrl: string) => Promise<unknown>;

132 },

133): Strategy {

134 const dir = opts?.dir ?? customStrategiesDir();

135 const note = opts?.onNote ?? ((l, m) => console.log(`[custom:${l}] ${m}`));

136 const importer = opts?.importer ?? ((url) => import(url));

137 const ctx = buildStrategyCtx();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

worker/src/strategies/custom.tsView on unpkg · L135

138 let loaded: LoadedModule | null = null;

139

140 async function load(): Promise<LoadedModule> {

141 const file = resolveStrategyFile(name, dir);

142 if (!file) {

143 return { mtimeMs: 0, strategy: null, error: `no strategy file "${name}" in ${dir}` };

144 }

145 const mtimeMs = statSync(file).mtimeMs;

146 if (loaded && loaded.mtimeMs === mtimeMs && loaded.strategy) return loaded;

147

148 try {

149 // mtime in the URL busts the ESM module cache → edits apply next tick.

150 const mod = (await importer(`${pathToFileURL(file).href}?v=${mtimeMs}`)) as Record<string, unknown>;

151 const candidate = (mod.default ?? mod.strategy) as LoadedModule["strategy"];

152 if (!candidate || typeof candidate.tick !== "function") {

153 return {

154 mtimeMs,

155 strategy: null,

cli/bin.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * merrymen CLI — the terminal front door.

4 *

5 * Install (no clone): npm install -g merrymen (or github:millw14/merrymen)

6 * Then: merrymen onboard && merrymen start

7 *

8 * merrymen onboard interactive setup wizard (keys, strategy, basket)

9 * merrymen start run web + worker together

10 * merrymen doctor diagnose the whole stack

11 * merrymen status what the band is doing right now

12 * merrymen strategy new scaffold a custom strategy in ~/.merrymen/strategies

Source & flagged code

3 flagged · loading source

worker/src/strategies/custom.tsView file

135const note = opts?.onNote ?? ((l, m) => console.log(`[custom:${l}] ${m}`)); L136: const importer = opts?.importer ?? ((url) => import(url)); L137: const ctx = buildStrategyCtx();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

worker/src/strategies/custom.tsView on unpkg · L135

cli/bin.mjsView file

20L21: import { spawn, spawnSync } from "node:child_process"; L22: import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; ... L32: // Where the USER's data lives — settings, grant, ledger, strategies. L33: const HOME = process.env.MERRYMEN_HOME ?? path.join(os.homedir(), ".merrymen"); L34: const SETTINGS = path.join(HOME, "settings.json"); ... L41: L42: const RPC_MAINNET = "https://rpc.mainnet.chain.robinhood.com"; L43: const RPC_TESTNET = "https://rpc.testnet.chain.robinhood.com"; ... L56: try { L57: return JSON.parse(readFileSync(file, "utf8").replace(/^/, "")); L58: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/bin.mjsView on unpkg · L20

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/bin.mjsView on unpkg · L20

Findings

1 High5 Medium5 Low

HighSandbox Evasion Gated Capabilitycli/bin.mjs

MediumDynamic Requireworker/src/strategies/custom.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencecli/bin.mjs

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

worker/src/strategies/custom.tsView file

Lines 115-155typescript

115interface LoadedModule {

116 mtimeMs: number;

117 strategy: { name?: string; tick: (snap: Snapshot, ctx: StrategyCtx) => unknown } | null;

118 error?: string;

119}

120

121/**

122 * Wrap a user strategy file as a Strategy. Import happens inside tick so a

123 * bad file never breaks worker startup, and an edited file reloads on mtime.

124 */

125export function makeCustomStrategy(

126 name: string,

127 opts?: {

128 dir?: string;

129 onNote?: (level: "ok" | "warn", message: string) => void;

130 /** Injectable for tests. */

131 importer?: (fileUrl: string) => Promise<unknown>;

132 },

133): Strategy {

134 const dir = opts?.dir ?? customStrategiesDir();

135 const note = opts?.onNote ?? ((l, m) => console.log(`[custom:${l}] ${m}`));

136 const importer = opts?.importer ?? ((url) => import(url));

137 const ctx = buildStrategyCtx();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

worker/src/strategies/custom.tsView on unpkg · L135

138 let loaded: LoadedModule | null = null;

139

140 async function load(): Promise<LoadedModule> {

141 const file = resolveStrategyFile(name, dir);

142 if (!file) {

143 return { mtimeMs: 0, strategy: null, error: `no strategy file "${name}" in ${dir}` };

144 }

145 const mtimeMs = statSync(file).mtimeMs;

146 if (loaded && loaded.mtimeMs === mtimeMs && loaded.strategy) return loaded;

147

148 try {

149 // mtime in the URL busts the ESM module cache → edits apply next tick.

150 const mod = (await importer(`${pathToFileURL(file).href}?v=${mtimeMs}`)) as Record<string, unknown>;

151 const candidate = (mod.default ?? mod.strategy) as LoadedModule["strategy"];

152 if (!candidate || typeof candidate.tick !== "function") {

153 return {

154 mtimeMs,

155 strategy: null,

cli/bin.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * merrymen CLI — the terminal front door.

4 *

5 * Install (no clone): npm install -g merrymen (or github:millw14/merrymen)

6 * Then: merrymen onboard && merrymen start

7 *

8 * merrymen onboard interactive setup wizard (keys, strategy, basket)

9 * merrymen start run web + worker together

10 * merrymen doctor diagnose the whole stack

11 * merrymen status what the band is doing right now

12 * merrymen strategy new scaffold a custom strategy in ~/.merrymen/strategies