
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
@morphllm/opencode-morph-plugin
Advanced tools
OpenCode plugin for Morph SDK - fast apply, WarpGrep codebase search
Source repository: https://github.com/morphllm/opencode-morph-plugin
OpenCode plugin for Morph. Four tools:

On production repos and SWE-Bench Pro, enabling WarpGrep and compaction improves task accuracy by 6%, reduces cost, and is net 28% faster.
Sign up at morphllm.com/dashboard and export it:
export MORPH_API_KEY="sk-..."
Add this to your shell profile (~/.zshrc, ~/.bashrc, etc.) so it persists.
cd ~/.config/opencode
bun i @morphllm/opencode-morph-plugin
Edit ~/.config/opencode/opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"plugin": ["@morphllm/opencode-morph-plugin"],
"instructions": [
"node_modules/@morphllm/opencode-morph-plugin/instructions/morph-tools.md"
]
}
opencode
You should see morph_edit, warpgrep_codebase_search, and warpgrep_github_search in the available tools. Compaction runs automatically in the background.
Context compression via the Morph Compact API. In current OpenCode 1.14.x releases, only OpenCode native compaction writes the persisted summary message that future turns and the sidebar use. This plugin handles that path by pre-compressing the selected history with Morph before OpenCode's native compaction model writes its summary.
experimental.chat.messages.transform hook receives the history OpenCode selected for compactionsession.compactedThe Morph toast means the compaction input was compressed for OpenCode. Seeing OpenCode native compaction immediately after the toast is expected; that is the mechanism that persists the summary. The "Context: X tokens" number in the sidebar is based on OpenCode's stored assistant token usage, so it updates after OpenCode finishes compaction and/or after the next assistant response, not at the instant the Morph toast appears.
For non-native transform calls, the plugin uses a default threshold of 70% of the model's context window. With a 1M token model, that is roughly 700k estimated tokens. You can override this with a fixed token limit:
# Compact when conversation exceeds 20,000 tokens
export MORPH_COMPACT_TOKEN_LIMIT=20000
For aggressive compaction during testing:
export MORPH_COMPACT_TOKEN_LIMIT=5000
Check the OpenCode log files in ~/.local/share/opencode/log/. Look for entries with service=morph:
grep "service=morph" ~/.local/share/opencode/log/*.log | grep -i compact
When compaction fires, you'll see entries like:
INFO service=morph OpenCode native compaction triggered; Morph will pre-compress selected history and OpenCode will persist the summary.
INFO service=morph Native compaction: compressing 42 selected messages (210137 chars) before OpenCode writes its persisted summary.
INFO service=morph Native compaction: Morph compressed 42 messages -> 1 summary (15142 chars). Ratio: 20% kept (244ms)
INFO service=morph OpenCode native compaction completed; cleared Morph transient compaction state.
You'll also see a toast notification in the OpenCode UI:
Prepared OpenCode compaction with Morph (20% kept) | 244ms
If OpenCode native compaction is not involved and a future OpenCode version calls experimental.chat.messages.transform before normal LLM turns, the plugin still has the older proactive path. In that path, subsequent LLM calls can show:
INFO service=morph Under threshold - reusing frozen block. Messages: 5 -> 5
morph_edit)10,500+ tok/s code merging. The LLM writes partial snippets with lazy markers (// ... existing code ...), Morph merges them into the full file.
Best for large files (300+ lines) and multiple scattered changes. For small exact replacements, use OpenCode's built-in edit tool.
warpgrep_codebase_search)Fast agentic codebase search. Runs multi-turn ripgrep + file reads to find relevant code contexts. Sub-6s per query. Best for exploratory queries ("how does X work?", "where is Y handled?").
warpgrep_github_search)Search public GitHub repositories without cloning. Pass an owner/repo or GitHub URL and a search query. Returns relevant file contexts from Morph's indexed public repo search.
All configuration is via environment variables.
| Variable | Default | Description |
|---|---|---|
MORPH_API_KEY | required | Your Morph API key |
MORPH_COMPACT_TOKEN_LIMIT | auto (70% of model window) | Fixed token threshold for compaction |
MORPH_COMPACT_CONTEXT_THRESHOLD | 0.7 | Fraction of model context window to trigger compaction (used when TOKEN_LIMIT is not set) |
MORPH_COMPACT_PRESERVE_RECENT | 1 | Number of recent messages to keep uncompacted |
MORPH_COMPACT_RATIO | 0.3 | Target compression ratio (0.05-1.0, lower = more aggressive) |
MORPH_COMPACT | true | Set false to disable compaction |
MORPH_EDIT | true | Set false to disable Fast Apply |
MORPH_WARPGREP | true | Set false to disable WarpGrep |
MORPH_WARPGREP_GITHUB | true | Set false to disable public repo search |
bun install
bun test
bun run build
bun run typecheck
To test locally with OpenCode, symlink the plugin:
rm -rf ~/.config/opencode/node_modules/@morphllm/opencode-morph-plugin
ln -s /path/to/this/repo ~/.config/opencode/node_modules/@morphllm/opencode-morph-plugin
bun run build # rebuild after changes
FAQs
OpenCode plugin for Morph SDK - fast apply, WarpGrep codebase search
The npm package @morphllm/opencode-morph-plugin receives a total of 322 weekly downloads. As such, @morphllm/opencode-morph-plugin popularity was classified as not popular.
We found that @morphllm/opencode-morph-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.