registry / @momentic/qa-node / 0.25.0
@momentic/qa-node@0.25.0
A Node.js build of qa for Windows Server 2016, which Bun does not support.
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest exposes only a CLI binary and has no lifecycle hooks. Source inspection found API-key use with the Momentic service by default, not evidence of the scanner’s alleged credential redirection or persistence.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the qa CLI and authenticates.
Impact
No confirmed attack surface was established in the inspected source.
Mechanism
The CLI sends its API key to the configured API server, which defaults to Momentic’s API.
AI rationale
The manifest exposes only a CLI binary and has no lifecycle hooks. Source inspection found API-key use with the Momentic service by default, not evidence of the scanner’s alleged credential redirection or persistence.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI binary and lists no lifecycle scripts.
- The CLI sends its configured API key in an Authorization header; its default service endpoint is Momentic’s API.
- The default server selection uses the Momentic API endpoint, and the CLI option permits an operator-supplied server.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Oversized source lightweight scan
mo.mjs5.95 MB file, sampled 256 KB
Filesystem
Source & flagged code
12 flaggedmo.mjsView file
35import pye from 'node:tty';
L36: import { execSync, spawnSync, spawn as spawn$1 } from 'child_process';
L37: import { randomUUID, generateKeyPairSync, privateDecrypt, constants, createHash } from 'node:crypto';
...
L41: import oQe, { mkdtemp, writeFile, rm as rm$1, open, readFile as readFile$1, stat, readdir as readdir$1, link, mkdir, chmod, constants as constants$1, rename } from 'node:fs/promise...
L42: import { validateHeaderValue } from 'http';
L43: import { pipeline } from 'node:stream/promises';
...
L46: const require$1 = createRequire(import.meta.url);
L47: var Yje=Object.create;var J1=Object.defineProperty;var Xje=Object.getOwnPropertyDescriptor;var Jje=Object.getOwnPropertyNames;var Kje=Object.getPrototypeOf,Zje=Object.prototype.has...
L48: `).join(`
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
mo.mjsView on unpkg · L359import { EventEmitter as EventEmitter$1, errorMonitor } from 'node:events';
L10: import * as A8 from 'node:http';
L11: import { createServer } from 'node:http';
...
L14: import { AsyncLocalStorage, AsyncResource } from 'node:async_hooks';
L15: import pQe, { execFile, spawn } from 'node:child_process';
L16: import Un, { readFile, readdir, openAsBlob, writeFileSync, renameSync, rmSync, realpathSync, openSync, fchmodSync, closeSync, createReadStream, existsSync, readFileSync as readFile...
...
L26: import { Readable } from 'node:stream';
L27: import { gunzipSync, createGzip } from 'node:zlib';
L28: import * as qc from 'node:net';
...
L36: import { execSync, spawnSync, spawn as spawn$1 } from 'child_process';
L37: import { randomUUID, generateKeyPairSync, privateDecrypt, constants, createH
Findings
4 Critical6 High5 Medium4 Low
CriticalSame File Env Network Executionmo.mjs
CriticalDownload Executemo.mjs
CriticalRemote Asset Decode Executemo.mjs
CriticalTrigger Reachable Dangerous Capabilitymo.mjs
HighChild Processmo.mjs
HighShellmo.mjs
HighCredential Redirect Persistencemo.mjs
HighCommand Output Exfiltrationmo.mjs
HighTrigger Reachable Command Output Exfiltrationmo.mjs
HighSemantic Analysis Limitedmo.mjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filemo.mjs
Affected versions and remediation
This report applies to @momentic/qa-node@0.25.0.
See all versions of @momentic/qa-node for other recorded verdicts.
- Review the evidence and your use of @momentic/qa-node@0.25.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.