
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
@morphllm/subagents
Advanced tools
Subagent SDK - planning, filesystem, subagents, teams, DOCX, and more
Modular AI subagents for document processing. Built for use with OpenAI-compatible APIs.
Subagents follow the "Agents as Tools" pattern—specialized secondary agents that your main agent delegates to for domain-specific tasks:
┌─────────────────────┐
│ MAIN AGENT │
│ │
│ • Orchestrates │
│ • Plans │
│ • Delegates │
└──────────┬──────────┘
│
┌────────────────────────────┼────────────────────────────┐
│ │ │
▼ ▼ ▼
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ DOCX AGENT │ │ PDF AGENT │ │ YOUR AGENT │
│ │ │ │ │ │
│ "Review this │ │ "Fill out │ │ Domain-specific│
│ contract" │ │ this form" │ │ capabilities │
└────────┬────────┘ └────────┬────────┘ └────────┬────────┘
│ │ │
▼ ▼ ▼
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Track changes │ │ Form filling │ │ Custom tools │
│ Comments │ │ Annotations │ │ & APIs │
│ Document edits │ │ (Coming soon) │ │ │
└─────────────────┘ └─────────────────┘ └─────────────────┘
The main agent handles orchestration and planning. When it encounters a specialized task (editing a Word doc, filling a PDF form), it delegates to the appropriate subagent which handles all the domain complexity—file formats, APIs, and tool execution.
npm install @morphllm/subagents
| Subagent | Description | Status |
|---|---|---|
| DOCX | Track changes, comments, and document editing | Available |
| Form filling and annotations | Coming Soon |
import { DocxClient } from '@morphllm/subagents/docx';
const client = new DocxClient();
// Upload a document
const doc = await client.upload(file);
// Read content
const content = await client.read(doc.doc_id);
// Add comments and track changes
await client.edit(doc.doc_id, [
{ type: 'add_comment', para_text: 'Introduction', comment: 'Needs citation' },
{ type: 'insert_text', para_text: 'Introduction', after: '.', new_text: ' [1]' },
]);
// Download the edited document
const blob = await client.download(doc.doc_id);
import OpenAI from 'openai';
import { DocxClient, DocxAgent } from '@morphllm/subagents/docx';
const openai = new OpenAI();
const client = new DocxClient();
// Upload a document first
const file = new File([documentBuffer], 'contract.docx');
const { doc_id } = await client.upload(file);
// Create agent with the document
const agent = new DocxAgent({
openai,
documentId: doc_id,
});
// Run with natural language
const result = await agent.run('Review this contract and flag any issues');
console.log(result.response);
console.log(result.toolCalls);
// Download the edited document
const editedDoc = await client.download(doc_id);
for await (const event of agent.runStream('Add comments to unclear sections')) {
if (event.type === 'content_delta') {
process.stdout.write(event.delta.text);
} else if (event.type === 'tool_start') {
console.log(`\nExecuting: ${event.tool.name}`);
}
}
// Import everything
import { DocxClient, DocxAgent, BaseClient } from '@morphllm/subagents';
// Import specific modules
import { DocxClient, DocxAgent } from '@morphllm/subagents/docx';
import { BaseClient, BaseAgent } from '@morphllm/subagents/core';
Extend the base classes to create your own subagents:
import { BaseClient, BaseAgent } from '@morphllm/subagents/core';
import type { Tool } from '@morphllm/subagents/core';
class MyClient extends BaseClient {
protected getDefaultApiUrl() {
return 'https://my-api.example.com';
}
async myMethod() {
return this.get('/my-endpoint');
}
}
class MyAgent extends BaseAgent<MyClient> {
protected getDefaultModel() {
return 'gpt-4';
}
protected getDefaultInstructions() {
return 'You are a helpful assistant.';
}
protected getTools(): Tool[] {
return [/* your tools */];
}
protected async executeTool(name: string, args: Record<string, unknown>) {
// Execute tool calls
}
}
| Variable | Description | Default |
|---|---|---|
DOCX_API_URL | DOCX service URL | https://docx.morphllm.com |
MIT
FAQs
Subagent SDK - planning, filesystem, subagents, teams, DOCX, and more
We found that @morphllm/subagents demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.