registry / morphyagent / 0.2.2

morphyagent@0.2.2

Self-hosted, self-evolving AI agent with its own dashboard.

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 433 file(s), 11.6 MB of source, external domains: 127.0.0.1, aistudio.google.com, api.anthropic.com, api.cerebras.ai, api.deepseek.com, api.groq.com, api.mistral.ai, api.morphyagent.com, api.openai.com, api.telegram.org, api.x.ai, auth.openai.com, cdn.jsdelivr.net, claude.ai, cloud.cerebras.ai, console.anthropic.com, console.groq.com, console.mistral.ai, console.x.ai, example.com, fonts.googleapis.com, fonts.gstatic.com, generativelanguage.googleapis.com, github.com, morphyagent.com, ollama.com, openrouter.ai, platform.deepseek.com, platform.openai.com, react.dev, registry.npmjs.org, rpc.tempo.xyz, t.me, www.ibm.com, www.morphyagent.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist-chat/assets/chat-flfGrcHh.jsView file

283?|[ L284: \v\f\u2028\u2029])`),t));else if(c===`posix`)if(!i&&(u===`graph`||u===`print`)){if(r===`strict`)throw Error(`POSIX class "${u}" requires min target ES2024 or non-strict accuracy`)... L285: `).join(`

High

Child Process

Package source references child process execution.

dist-chat/assets/chat-flfGrcHh.jsView on unpkg · L283

dist-chat/assets/codeql-DlIhJTR7.jsView file

1var e=[Object.freeze(JSON.parse(`{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\b...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-chat/assets/codeql-DlIhJTR7.jsView on unpkg · L1

supervisor/index.tsView file

1import http from 'http'; L2: import net from 'net'; ... L26: import { ensureFileDirs, saveAttachment, saveAudio, MAX_ATTACHMENTS_PER_MESSAGE, MAX_TOTAL_ATTACHMENT_BYTES, type SavedFile } from './file-saver.js'; L27: import { approxBase64Bytes } from './harnesses/attachment-policy.js'; L28: import { startViteDevServers, stopViteDevServers } from './vite-dev.js'; L29: import { startScheduler, stopScheduler, readPulseConfig, readCronsConfig, nextRunISO, describeCron } from './scheduler.js'; L30: import { execSync, spawn as cpSpawn } from 'child_process'; L31: import crypto from 'crypto'; ... L78: // fixed token budget. Auto-compaction stays on as the in-turn safety net. L79: const CONTEXT_RECYCLE_TOKENS = Number(process.env.MORPHY_CONTEXT_RECYCLE_TOKENS) || 140_000; L80: const CONTEXT_REC

Low

Weak Crypto

Package source references weak cryptographic algorithms.

supervisor/index.tsView on unpkg · L1

bin/cli.jsView file

101ensureNpmrc(ROOT); L102: execSync('npm install --omit=dev', { cwd: ROOT, stdio: 'inherit' }); L103: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L101

12// - The supervisor writes ~/.morphy/supervisor.json at boot (pid/startedAt/ L13: // version/port). That pidfile — not launchctl/systemctl alone — is the L14: // source of truth for "is Morphy running", so status/logs can never show a ... L20: // hosted provisioning: `cli.js init --hosted` → __HOSTED_READY__=<json>. L21: // foreground boot parses supervisor stdout markers __READY__, L22: // __TUNNEL_URL__=, __RELAY_URL__=, __VITE_WARM__, __TUNNEL_FAILED__. ... L25: L26: import { spawn, spawnSync, execSync, execFileSync } from 'child_process'; L27: import fs from 'fs'; ... L32: L33: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L34:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/cli.jsView on unpkg · L12

supervisor/tunnel.tsView file

35const a = p === 'win32' L36: ? (process.env.PROCESSOR_ARCHITECTURE || os.arch()).toLowerCase() L37: : os.arch(); L38: const base = 'https://github.[redacted]'; L39: ... L48: if (p === 'win32') { L49: execSync(`curl.exe -fsSL -o "${paths.cloudflared}" "${url}"`, { stdio: 'ignore' }); L50: } else if (url.endsWith('.tgz')) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

supervisor/tunnel.tsView on unpkg · L35

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 21546 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

workspace/client/public/morphy_bounce.webmView file

•path = workspace/client/public/morphy_bounce.webm kind = high_entropy_blob sizeBytes = 645337 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

workspace/client/public/morphy_bounce.webmView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code