registry / @momentic/qa-node / 0.29.0
@momentic/qa-node@0.29.0
A Node.js build of qa for Windows Server 2016, which Bun does not support.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifest exposes a CLI without lifecycle hooks, and the reviewed outbound behavior is structured logging to the package's Momentic metrics service. The scanner's high-risk labels were not supported by inspected source showing credential theft, remote code execution, or another attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running a CLI command records and flushes command logs.
Impact
The service receives CLI operational metadata; no concrete attacker impact was established.
Mechanism
The executable posts structured log records to the fixed Momentic metrics endpoint with service headers.
AI rationale
The manifest exposes a CLI without lifecycle hooks, and the reviewed outbound behavior is structured logging to the package's Momentic metrics service. The scanner's high-risk labels were not supported by inspected source showing credential theft, remote code execution, or another attack.
Evidence
mo.mjs
Network endpoints1
us-west.metrics.momentic.ai
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes mo.mjs as the CLI and declares no lifecycle hook.
- The executable parses CLI arguments, records command status, and flushes its logs when the command finishes.
- The logger identifies records as CLI logs and includes timestamps, severity, service metadata, and structured log fields.
- The logger posts records to Momentic's metrics endpoint using fixed service headers; the manifest identifies Momentic as the project.
- No concrete attack behavior was identified in the inspected executable.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
13 flaggedmo.mjsView file
35import KCe from 'node:tty';
L36: import { execSync, spawnSync, spawn as spawn$1 } from 'child_process';
L37: import { randomUUID, createHash, generateKeyPairSync, privateDecrypt, constants } from 'node:crypto';
...
L41: import m6e, { mkdtemp, writeFile, rm as rm$1, mkdir, open, readFile as readFile$1, stat, readdir as readdir$1, link, chmod, constants as constants$1, rename } from 'node:fs/promise...
L42: import { validateHeaderValue } from 'http';
L43: import { finished, pipeline } from 'node:stream/promises';
...
L46: const require$1 = createRequire(import.meta.url);
L47: var yYe=Object.create;var HF=Object.defineProperty;var bYe=Object.getOwnPropertyDescriptor;var CYe=Object.getOwnPropertyNames;var IYe=Object.getPrototypeOf,TYe=Object.prototype.has...
L48: `).join(`
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
mo.mjsView on unpkg · L359import { EventEmitter as EventEmitter$1, errorMonitor } from 'node:events';
L10: import * as i4 from 'node:http';
L11: import { createServer } from 'node:http';
...
L14: import { AsyncLocalStorage, AsyncResource } from 'node:async_hooks';
L15: import T6e, { execFile, spawn } from 'node:child_process';
L16: import Vn, { readFile, readdir, openAsBlob, rmSync, writeFileSync, renameSync, realpathSync, openSync, fchmodSync, closeSync, createReadStream, existsSync, readFileSync as readFile...
...
L26: import { Readable } from 'node:stream';
L27: import { gunzipSync, createGzip } from 'node:zlib';
L28: import * as cl from 'node:net';
...
L36: import { execSync, spawnSync, spawn as spawn$1 } from 'child_process';
L37: import { randomUUID, createHash, generateKeyPairSync, privateDecrypt, consta
Findings
5 Critical6 High5 Medium4 Low
CriticalSame File Env Network Executionmo.mjs
CriticalHardcoded Runtime Data Exfiltrationmo.mjs
CriticalDownload Executemo.mjs
CriticalRemote Asset Decode Executemo.mjs
CriticalTrigger Reachable Dangerous Capabilitymo.mjs
HighChild Processmo.mjs
HighShellmo.mjs
HighCredential Redirect Persistencemo.mjs
HighCommand Output Exfiltrationmo.mjs
HighTrigger Reachable Command Output Exfiltrationmo.mjs
HighSemantic Analysis Limitedmo.mjs
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @momentic/qa-node@0.29.0.
See all versions of @momentic/qa-node for other recorded verdicts.
- Review the evidence and your use of @momentic/qa-node@0.29.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.