registry / morphis / 0.7.2

morphis@0.7.2

Morphis is a modern, opinionated web framework designed for developers who love the elegant patterns of Laravel but crave the speed of the Bun runtime. It brings a full-stack, "batteries-included" architecture to the TypeScript ecosystem, optimized for bo

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 59 file(s), 469 KB of source, external domains: api.cloudflare.com, dash.cloudflare.com, developers.cloudflare.com, docs.docker.com, github.com, registry.cloudflare.com

Source & flagged code

2 flagged

scripts/commands/migrate.tsView file

Lines 60-100typescript

60 const value = trimmed.slice(eq + 1);

61 process.env[key] ??= value;

62 }

63 }

64 }

66 // ── Project guard ─────────────────────────────────────────────────────────

67 if (!fs.existsSync(path.join(cwd, 'package.json'))) {

68 console.error(chalk.red('\n Not in a project directory — package.json not found\n'));

69 process.exit(1);

70 }

72 const configPath = path.join(cwd, 'src', 'config', 'database.ts');

73 if (!fs.existsSync(configPath)) {

74 console.error(chalk.red('\n src/config/database.ts not found. Run: morphis new:connection\n'));

75 process.exit(1);

76 }

78 // ── Load database config ──────────────────────────────────────────────────

79 let databases: Record<string, any>;

80 try {

81 const mod = await import(configPath);

82 databases = mod.default;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/commands/migrate.tsView on unpkg · L80

83 } catch (err) {

84 console.error(chalk.red(

85 `\n Failed to load src/config/database.ts: ${err instanceof Error ? err.message : String(err)}\n`,

86 ));

87 process.exit(1);

88 }

90 if (!databases || typeof databases !== 'object' || Object.keys(databases).length === 0) {

91 console.error(chalk.red('\n src/config/database.ts has no connections configured\n'));

92 process.exit(1);

93 }

95 // ── Resolve target connection ─────────────────────────────────────────────

96 const entries = Object.entries(databases);

97 const [resolvedConnectionName, config]: [string, any] = connectionName === 'default'

98 ? (entries.find(([, d]) => d.isDefault) ?? entries[0])

99 : [connectionName, databases[connectionName]];

100

scripts/commands/deploy.tsView file

Lines 1-23typescript

1import chalk from 'chalk';

2import fs from 'fs';

3import path from 'path';

4import { spawn, execSync } from 'child_process';

5import { runDockerBuild, generateDockerfile, detectExtraProjectFiles, prepareDockerBuildContext } from './dockerBuild';

Source & flagged code

2 flagged · loading source

scripts/commands/migrate.tsView file

80try { L81: const mod = await import(configPath); L82: databases = mod.default;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/commands/migrate.tsView on unpkg · L80

scripts/commands/deploy.tsView file

3import path from 'path'; L4: import { spawn, execSync } from 'child_process'; L5: import { runDockerBuild, generateDockerfile, detectExtraProjectFiles, prepareDockerBuildContext } from './dockerBuild'; ... L13: function getProjectName(cwd: string, server: string): string { L14: const pkgPath = path.join(cwd, 'package.json'); L15: if (fs.existsSync(pkgPath)) { L16: try { L17: const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8')); L18: if (typeof pkg.name === 'string' && pkg.name) return pkg.name; ... L48: if (regionArg) return regionArg; L49: if (process.env.AWS_DEFAULT_REGION) return process.env.AWS_DEFAULT_REGION; L50: if (process.env.AWS_REGION) return process.env.AWS_REGION;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/commands/deploy.tsView on unpkg · L3

Findings

1 High5 Medium4 Low

HighSandbox Evasion Gated Capabilityscripts/commands/deploy.ts

MediumDynamic Requirescripts/commands/migrate.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

scripts/commands/migrate.tsView file

Lines 60-100typescript

60 const value = trimmed.slice(eq + 1);

61 process.env[key] ??= value;

62 }

63 }

64 }

66 // ── Project guard ─────────────────────────────────────────────────────────

67 if (!fs.existsSync(path.join(cwd, 'package.json'))) {

68 console.error(chalk.red('\n Not in a project directory — package.json not found\n'));

69 process.exit(1);

70 }

72 const configPath = path.join(cwd, 'src', 'config', 'database.ts');

73 if (!fs.existsSync(configPath)) {

74 console.error(chalk.red('\n src/config/database.ts not found. Run: morphis new:connection\n'));

75 process.exit(1);

76 }

78 // ── Load database config ──────────────────────────────────────────────────

79 let databases: Record<string, any>;

80 try {

81 const mod = await import(configPath);

82 databases = mod.default;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/commands/migrate.tsView on unpkg · L80

83 } catch (err) {

84 console.error(chalk.red(

85 `\n Failed to load src/config/database.ts: ${err instanceof Error ? err.message : String(err)}\n`,

86 ));

87 process.exit(1);

88 }

90 if (!databases || typeof databases !== 'object' || Object.keys(databases).length === 0) {

91 console.error(chalk.red('\n src/config/database.ts has no connections configured\n'));

92 process.exit(1);

93 }

95 // ── Resolve target connection ─────────────────────────────────────────────

96 const entries = Object.entries(databases);

97 const [resolvedConnectionName, config]: [string, any] = connectionName === 'default'

98 ? (entries.find(([, d]) => d.isDefault) ?? entries[0])

99 : [connectionName, databases[connectionName]];

100

scripts/commands/deploy.tsView file

Lines 1-23typescript

1import chalk from 'chalk';

2import fs from 'fs';

3import path from 'path';

4import { spawn, execSync } from 'child_process';

5import { runDockerBuild, generateDockerfile, detectExtraProjectFiles, prepareDockerBuildContext } from './dockerBuild';