
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
@morphllm/opencode-morph-plugin
Advanced tools
OpenCode plugin for Morph SDK - fast apply, WarpGrep codebase search
Source repository: https://github.com/morphllm/opencode-morph-plugin
OpenCode plugin for Morph. Four tools:

On production repos and SWE-Bench Pro, enabling WarpGrep and compaction improves task accuracy by 6%, reduces cost, and is net 28% faster.
Sign up at morphllm.com/dashboard and export it:
export MORPH_API_KEY="sk-..."
Add this to your shell profile (~/.zshrc, ~/.bashrc, etc.) so it persists.
cd ~/.config/opencode
bun i @morphllm/opencode-morph-plugin
Edit ~/.config/opencode/opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"plugin": ["@morphllm/opencode-morph-plugin"],
"instructions": [
"node_modules/@morphllm/opencode-morph-plugin/instructions/morph-tools.md"
]
}
opencode
You should see morph_edit, warpgrep_codebase_search, and warpgrep_github_search in the available tools. Compaction runs automatically in the background.
Context compression via the Morph Compact API. Runs automatically before each LLM call when the conversation exceeds a token threshold.
The LLM receives compressed history + your latest prompt. The "Context: X tokens" number in the sidebar reflects the actual tokens sent (post-compaction).
By default, compaction triggers at 70% of the model's context window. You can override this with a fixed token limit:
# Compact when conversation exceeds 20,000 tokens
export MORPH_COMPACT_TOKEN_LIMIT=20000
For aggressive compaction during testing:
export MORPH_COMPACT_TOKEN_LIMIT=5000
Check the OpenCode log files in ~/.local/share/opencode/log/. Look for entries with service=morph:
grep "service=morph" ~/.local/share/opencode/log/*.log | grep -i compact
When compaction fires, you'll see entries like:
INFO service=morph First compaction: 2 messages (30137 chars), keeping 1 recent. Threshold crossed: 30178 >= 15000
INFO service=morph Compact: 2 messages -> 2 frozen (15142 chars). Messages: 3 -> 3. Ratio: 45% kept (244ms)
You'll also see a toast notification in the OpenCode UI when compaction triggers.
On subsequent LLM calls (before re-compaction is needed), you'll see:
INFO service=morph Under threshold - reusing frozen block. Messages: 5 -> 5
morph_edit)10,500+ tok/s code merging. The LLM writes partial snippets with lazy markers (// ... existing code ...), Morph merges them into the full file.
Best for large files (300+ lines) and multiple scattered changes. For small exact replacements, use OpenCode's built-in edit tool.
warpgrep_codebase_search)Fast agentic codebase search. Runs multi-turn ripgrep + file reads to find relevant code contexts. Sub-6s per query. Best for exploratory queries ("how does X work?", "where is Y handled?").
warpgrep_github_search)Search public GitHub repositories without cloning. Pass an owner/repo or GitHub URL and a search query. Returns relevant file contexts from Morph's indexed public repo search.
All configuration is via environment variables.
| Variable | Default | Description |
|---|---|---|
MORPH_API_KEY | required | Your Morph API key |
MORPH_COMPACT_TOKEN_LIMIT | auto (70% of model window) | Fixed token threshold for compaction |
MORPH_COMPACT_CONTEXT_THRESHOLD | 0.7 | Fraction of model context window to trigger compaction (used when TOKEN_LIMIT is not set) |
MORPH_COMPACT_PRESERVE_RECENT | 1 | Number of recent messages to keep uncompacted |
MORPH_COMPACT_RATIO | 0.3 | Target compression ratio (0.05-1.0, lower = more aggressive) |
MORPH_COMPACT | true | Set false to disable compaction |
MORPH_EDIT | true | Set false to disable Fast Apply |
MORPH_WARPGREP | true | Set false to disable WarpGrep |
MORPH_WARPGREP_GITHUB | true | Set false to disable public repo search |
bun install
bun test
bun run build
bun run typecheck
To test locally with OpenCode, symlink the plugin:
rm -rf ~/.config/opencode/node_modules/@morphllm/opencode-morph-plugin
ln -s /path/to/this/repo ~/.config/opencode/node_modules/@morphllm/opencode-morph-plugin
bun run build # rebuild after changes
FAQs
OpenCode plugin for Morph SDK - fast apply, WarpGrep codebase search
The npm package @morphllm/opencode-morph-plugin receives a total of 322 weekly downloads. As such, @morphllm/opencode-morph-plugin popularity was classified as not popular.
We found that @morphllm/opencode-morph-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.