registry / merrymen / 0.7.2

merrymen@0.7.2

Trading agents you never have to trust — self-hosted, keys stay on your machine, caps enforced by the account contract on-chain. For Robinhood Chain; Telegram control; write-your-own strategies.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 73 file(s), 502 KB of source, external domains: api.groq.com, api.openai.com, api.pimlico.io, api.telegram.org, blue-api.morpho.org, cdn.robinhood.com, console.anthropic.com, console.groq.com, dashboard.pimlico.io, docs.rialto.xyz, explorer.testnet.chain.robinhood.com, faucet.testnet.chain.robinhood.com, merrymen.dev, nodejs.org, rialto-trade-api.rialto.xyz, robinhoodchain.blockscout.com, rpc.mainnet.chain.robinhood.com, rpc.testnet.chain.robinhood.com, t.me, www.w3.org

Source & flagged code

7 flagged

cli/bin.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * merrymen CLI — the terminal front door.

4 *

5 * Install (no clone): npm install -g merrymen (or github:millw14/merrymen)

6 * Then: merrymen onboard && merrymen start

7 *

8 * merrymen onboard interactive setup wizard (keys, strategy, basket)

9 * merrymen start run web + worker together

10 * merrymen doctor diagnose the whole stack

11 * merrymen status what the band is doing right now

12 * merrymen strategy new scaffold a custom strategy in ~/.merrymen/strategies

13 * merrymen strategy list builtins + your strategies

14 * merrymen selftest one policy-legal no-op through the full pipeline

15 * merrymen kill terminal kill switch (deletes the grant)

16 *

17 * Zero dependencies. All user data lives in ~/.merrymen (override with

18 * MERRYMEN_HOME) — the install location stays disposable.

19 */

21import { spawn, spawnSync } from "node:child_process";

22import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

cli/bin.mjsView on unpkg · L20

23import { readdir } from "node:fs/promises";

24import os from "node:os";

25import path from "node:path";

26import readline from "node:readline";

27import { fileURLToPath } from "node:url";

28import { banner, c, spinner, type as typeOut, withSpinner } from "./ui.mjs";

30// Where the PACKAGE lives (npm global dir or a checkout) — code, never data.

31const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

32// Where the USER's data lives — settings, grant, ledger, strategies.

33const HOME = process.env.MERRYMEN_HOME ?? path.join(os.homedir(), ".merrymen");

34const SETTINGS = path.join(HOME, "settings.json");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/bin.mjsView on unpkg · L20

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/bin.mjsView on unpkg · L20

35const GRANT = path.join(HOME, "grant.json");

36const HEARTBEAT = path.join(HOME, "heartbeat.json");

37const DB = path.join(HOME, "merrymen.db");

38const STRATEGIES = path.join(HOME, "strategies");

39const PKG_STRATEGIES = path.join(ROOT, "strategies");

40const WELCOMED = path.join(HOME, ".welcomed");

Lines 113-153javascript

113 return files

114 .filter((f) => /\.(ts|mts|mjs|js)$/.test(f) && !f.startsWith("."))

115 .map((f) => f.replace(/\.(ts

Lines 724-764javascript

724

725 const resolved =

726 process.platform === "win32" ? sh("where", ["merrymen"]) : sh("which", ["merrymen"]);

727 resolved

728 ? ok(`merrymen resolves ${dim(resolved.

worker/src/strategies/custom.tsView file

Lines 115-155typescript

115interface LoadedModule {

116 mtimeMs: number;

117 strategy: { name?: string; tick: (snap: Snapshot, ctx: StrategyCtx) => unknown }

web/.next/static/media/851c4691abdf3def-s.woff2View file

•path = web/.[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 9364 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/static/media/851c4691abdf3def-s.woff2View on unpkg

Source & flagged code

7 flagged · loading source

cli/bin.mjsView file

20L21: import { spawn, spawnSync } from "node:child_process"; L22: import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

cli/bin.mjsView on unpkg · L20

133const line = `${q(bin)} ${args.map(q).join(" ")}`; L134: return runner(line, { ...opts, shell: true, windowsHide: true }); L135: }

High

Shell

Package source references shell execution.

cli/bin.mjsView on unpkg · L133

20L21: import { spawn, spawnSync } from "node:child_process"; L22: import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; ... L32: // Where the USER's data lives — settings, grant, ledger, strategies. L33: const HOME = process.env.MERRYMEN_HOME ?? path.join(os.homedir(), ".merrymen"); L34: const SETTINGS = path.join(HOME, "settings.json"); ... L41: L42: const RPC_MAINNET = "https://rpc.mainnet.chain.robinhood.com"; L43: const RPC_TESTNET = "https://rpc.testnet.chain.robinhood.com"; ... L56: try { L57: return JSON.parse(readFileSync(file, "utf8").replace(/^/, "")); L58: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/bin.mjsView on unpkg · L20

744* Self-update. A running dashboard/worker holds file locks inside the global L745: * install, so a bare `npm i -g merrymen@latest` dies with EBUSY on Windows. L746: * This stops the band's child processes (NOT this CLI — the pattern matches ... L757: "ForEach-Object { Stop-Process -Id $_.ProcessId -Force }"; L758: spawnSync("powershell", ["-NoProfile", "-Command", ps], { stdio: "ignore" }); L759: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/bin.mjsView on unpkg · L744

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/bin.mjsView on unpkg · L20

worker/src/strategies/custom.tsView file

135const note = opts?.onNote ?? ((l, m) => console.log(`[custom:${l}] ${m}`)); L136: const importer = opts?.importer ?? ((url) => import(url)); L137: const ctx = buildStrategyCtx();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

worker/src/strategies/custom.tsView on unpkg · L135

web/.next/static/media/851c4691abdf3def-s.woff2View file

•path = web/.[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 9364 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/static/media/851c4691abdf3def-s.woff2View on unpkg

Findings

5 High5 Medium5 Low

HighChild Processcli/bin.mjs

HighShellcli/bin.mjs

HighSandbox Evasion Gated Capabilitycli/bin.mjs

HighRuntime Package Installcli/bin.mjs

HighShips High Entropy Blobweb/.next/static/media/851c4691abdf3def-s.woff2

MediumDynamic Requireworker/src/strategies/custom.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencecli/bin.mjs

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

cli/bin.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * merrymen CLI — the terminal front door.

4 *

5 * Install (no clone): npm install -g merrymen (or github:millw14/merrymen)

6 * Then: merrymen onboard && merrymen start

7 *

8 * merrymen onboard interactive setup wizard (keys, strategy, basket)

9 * merrymen start run web + worker together

10 * merrymen doctor diagnose the whole stack

11 * merrymen status what the band is doing right now

12 * merrymen strategy new scaffold a custom strategy in ~/.merrymen/strategies

13 * merrymen strategy list builtins + your strategies

14 * merrymen selftest one policy-legal no-op through the full pipeline

15 * merrymen kill terminal kill switch (deletes the grant)

16 *

17 * Zero dependencies. All user data lives in ~/.merrymen (override with

18 * MERRYMEN_HOME) — the install location stays disposable.

19 */

21import { spawn, spawnSync } from "node:child_process";

22import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

cli/bin.mjsView on unpkg · L20

23import { readdir } from "node:fs/promises";

24import os from "node:os";

25import path from "node:path";

26import readline from "node:readline";

27import { fileURLToPath } from "node:url";

28import { banner, c, spinner, type as typeOut, withSpinner } from "./ui.mjs";

30// Where the PACKAGE lives (npm global dir or a checkout) — code, never data.

31const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

32// Where the USER's data lives — settings, grant, ledger, strategies.

33const HOME = process.env.MERRYMEN_HOME ?? path.join(os.homedir(), ".merrymen");

34const SETTINGS = path.join(HOME, "settings.json");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/bin.mjsView on unpkg · L20

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/bin.mjsView on unpkg · L20

35const GRANT = path.join(HOME, "grant.json");

36const HEARTBEAT = path.join(HOME, "heartbeat.json");

37const DB = path.join(HOME, "merrymen.db");

38const STRATEGIES = path.join(HOME, "strategies");

39const PKG_STRATEGIES = path.join(ROOT, "strategies");

40const WELCOMED = path.join(HOME, ".welcomed");

Lines 113-153javascript

113 return files

114 .filter((f) => /\.(ts|mts|mjs|js)$/.test(f) && !f.startsWith("."))

115 .map((f) => f.replace(/\.(ts

Lines 724-764javascript

724

725 const resolved =

726 process.platform === "win32" ? sh("where", ["merrymen"]) : sh("which", ["merrymen"]);

727 resolved

728 ? ok(`merrymen resolves ${dim(resolved.

worker/src/strategies/custom.tsView file

Lines 115-155typescript

115interface LoadedModule {

116 mtimeMs: number;

117 strategy: { name?: string; tick: (snap: Snapshot, ctx: StrategyCtx) => unknown }

web/.next/static/media/851c4691abdf3def-s.woff2View file

•path = web/.[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 9364 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/static/media/851c4691abdf3def-s.woff2View on unpkg