registry / morphyagent / 0.3.3

morphyagent@0.3.3

Self-hosted, self-evolving AI agent with its own dashboard.

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 435 file(s), 11.6 MB of source, external domains: 127.0.0.1, aistudio.google.com, api.anthropic.com, api.cerebras.ai, api.deepseek.com, api.groq.com, api.mistral.ai, api.morphyagent.com, api.openai.com, api.telegram.org, api.x.ai, auth.openai.com, cdn.jsdelivr.net, claude.ai, cloud.cerebras.ai, console.anthropic.com, console.groq.com, console.mistral.ai, console.x.ai, example.com, fonts.googleapis.com, fonts.gstatic.com, generativelanguage.googleapis.com, github.com, morphyagent.com, ollama.com, openrouter.ai, platform.deepseek.com, platform.openai.com, react.dev, registry.npmjs.org, rpc.tempo.xyz, t.me, www.ibm.com, www.morphyagent.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

Lines 25-65json

25 "postcss.config.js",

26 "components.json"

27 ],

28 "keywords": [

29 "ai",

30 "bot",

31 "self-hosted",

32 "assistant",

33 "chatbot",

34 "raspberry-pi",

35 "morphy"

36 ],

37 "engines": {

38 "node": ">=18"

39 },

40 "scripts": {

41 "dev": "concurrently \"tsx watch supervisor/index.ts\" \"vite\"",

42 "build": "vite build && vite build --config vite.chat.config.ts",

43 "build:chat": "vite build --config vite.chat.config.ts",

44 "start": "node --import tsx/esm supervisor/index.ts",

45 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "dev:workspace": "vite",

47 "dev:docs": "cd ./docs && npx fumapress",

48 "sync:pi-models": "tsx scripts/sync-pi-models.ts",

49 "prepublishOnly": "vite build --config vite.chat.config.ts"

50 },

51 "dependencies": {

52 "@anthropic-ai/claude-agent-sdk": "^0.3.198",

53 "@anthropic-ai/sdk": "^0.100.0",

54 "@clack/prompts": "^1.1.0",

55 "@modelcontextprotocol/sdk": "^1.29.0",

56 "@openai/codex": "^0.142.5",

57 "@streamdown/code": "^1.1.1",

58 "@tailwindcss/vite": "^4.2.0",

59 "@vitejs/plugin-react": "^6.0.1",

60 "@whiskeysockets/baileys": "7.0.0-rc13",

61 "better-sqlite3": "^12.6.2",

62 "class-variance-authority": "^0.7.1",

63 "clsx": "^2.1.1",

64 "commander": "^14.0.3",

65 "cron-parser": "^5.5.0",

dist-chat/assets/cobol-hBjMZW-R.jsView file

Lines 1-1javascript

1import{t as e}from"./html-CzX0w7K_.js";import{t}from"./java-BqKEu7zh.js";var n=Object.freeze(JSON.parse(`{"displayName":"COBOL","fileTypes":["ccp","scbl","cobol","cbl","cblle","cblsrce","cblcpy","lks","pdv","cpy","copybook","cobcopy","fd","sel","scb","scbl","sqlcblle","cob","dds","def","src","ss","wks","bib","pco"],"name":"cobol","patterns":[{"match":"^([ *][ *][ *][ *][ *][ *])([Dd]\\\\s.*)$","name":"token.info-token.cobol"},{"captures":{"1":{"name":"constant.numeric.cobol"},"2":{"name":"comment.line.cobol.newpage"}},"match":"^([ *][ *][ *][ *][ *][ *])(/.*)$"},{"captures":{"1":{"name":"const ...

dist-chat/assets/codeql-DlIhJTR7.jsView file

Lines 1-1javascript

1var e=[Object.freeze(JSON.parse(`{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\babstract(?![0-9A-Z_a-z])","name":"storage.modifier.abstract.ql"},"additional":{"match":"\\\\badditional(?![0-9A-Z_a-z])","name":"storage.modifier.additional.ql"},"and":{"match":"\\\\band(?![0-9A-Z_a-z])","name":"keyword.other.and.ql"},"annotation":{"patterns":[{"include":"#bindingset-annotation"},{"include":"#language-annotation"},{"include":"#pragma-annotation"},{"include":"#annotation-keyword"}]},"annotation-keywor ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-chat/assets/codeql-DlIhJTR7.jsView on unpkg · L1

supervisor/index.tsView file

Lines 1-21typescript

1import http from 'http';

2import net from 'net';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

supervisor/index.tsView on unpkg · L1

3import fs from 'fs';

4import os

bin/cli.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

3// ─────────────────────────────────────────────────────────────────────────────

4// Morphy CLI — single entry point for the morphy command.

5//

6// Design rules (load-bearing — do not break):

7// - ZERO npm deps at top level. This file must run even when ~/.morphy's

8// node_modules is broken, because it IS the recovery tool (self-heal below).

9// - Every command daemonizes and returns the terminal. The only foreground

10// paths are `start --foreground` (debug) and platforms with no daemon

supervisor/tunnel.tsView file

Lines 15-55typescript

15 try { execSync(which, { stdio: 'ignore' }); return 'cloudflared'; } catch {}

17 // Check local install (validate by file size, never execute — avoids Windows popup)

18 if (!fs.existsSync(paths.cloudflared)) return

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 21546 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

workspace/client/public/morphy_bounce.webmView file

•path = workspace/client/public/morphy_bounce.webm kind = high_entropy_blob sizeBytes = 645337 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

workspace/client/public/morphy_bounce.webmView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code