registry / @momentic/wizard / 1.3.0
@momentic/wizard@1.3.0
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a real agent-extension lifecycle risk, but it is a user-invoked first-party onboarding flow rather than malicious npm lifecycle behavior. The scanner's remote-decode-execute claim is unsupported by source inspection.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run momentic-wizard, especially without a TTY or with --yes.
Impact
Expands local AI-agent command capability to invoke npx-hosted Momentic tooling.
Mechanism
agent MCP registration and global skills installation
AI rationale
This is a real agent-extension lifecycle risk, but it is a user-invoked first-party onboarding flow rather than malicious npm lifecycle behavior. The scanner's remote-decode-execute claim is unsupported by source inspection.
Evidence
package.jsonbin/cli.jsREADME.mdmomentic.config.yaml.vscode/settings.json.zed/settings.json~/.codeium/windsurf/mcp_config.json~/.config/Claude/claude_desktop_config.json~/.config/opencode/opencode.json~/.gemini/config/mcp_config.json
Network endpoints4
api.momentic.aiapi.workos.comstatic.momentic.ai87dca6db3c2794b22483da91686558d6@o4506426201800704.ingest.us.sentry.io/4511384282267648
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- bin/cli.js registers Momentic MCP commands in detected agent configs.
- Non-interactive mode defaults to detected agents plus global Momentic skills.
- Writes user-level Claude, Windsurf, Claude Desktop, OpenCode, and Gemini MCP configuration paths.
- Invokes detected Claude Code/Codex/VS Code CLIs to add a Momentic MCP server.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- All behavior is reached only through the momentic-wizard CLI.
- No fetched payload is decoded and executed; Base64 only builds a Cursor deeplink.
- Network calls are Momentic/WorkOS authentication, API, telemetry, and onboarding flows.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
7 flaggedbin/cli.jsView file
155${r.map(a=>a.configFilePath).join(`
L156: `)}`);if(r.length===0)throw new Z(`No valid Momentic project file (${Qe}) was found in the current directory or any parent directory. Run this command from inside your Momentic pro...
L157: `);if(a===-1)continue;let s=r.slice(0,a),c=r.slice(a+1).trim();i[s]=c;}return i}function Nc(e){if(e.startsWith("git@")){let t=e.split(":");if(t.length===2){let o=t[1].replace(".git...
...
L170: ${r.code(Ck(d,i))}`,a),t)try{await f3(d);}catch{e.warn(`Could not open a browser automatically. Paste ${r.code(d)} manually.`);}let h=e.spinner();h.start(s);try{let g=await dN({cli...
L171: `))i&&console.info(`\u2502 ${i}`);},success(o){console.info(`\u2714 ${o}`);},error(o){console.info(`\u2716 ${o}`);}}}};var gN=new xa({debug:false});function ee(){return gN}fun
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
bin/cli.jsView on unpkg · L155155Trigger-reachable chain: manifest.bin -> bin/cli.js
L155: ${r.map(a=>a.configFilePath).join(`
L156: `)}`);if(r.length===0)throw new Z(`No valid Momentic project file (${Qe}) was found in the current directory or any parent directory. Run this command from inside your Momentic pro...
L157: `);if(a===-1)continue;let s=r.slice(0,a),c=r.slice(a+1).trim();i[s]=c;}return i}function Nc(e){if(e.startsWith("git@")){let t=e.split(":");if(t.length===2){let o=t[1].replace(".git...
...
L170: ${r.code(Ck(d,i))}`,a),t)try{await f3(d);}catch{e.warn(`Could not open a browser automatically. Paste ${r.code(d)} manually.`);}let h=e.spinner();h.start(s);try{let g=await dN({cli...
L171: `))i&&console.info(`\u2502 ${i}`);},success(o){console.info(`\u2714 ${o}`);},error(o){console.info(`\u2716 ${o}`);}}}};var
Findings
2 Critical6 High3 Medium5 Low
CriticalRemote Asset Decode Executebin/cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/cli.js
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Low
Affected versions and remediation
This report applies to @momentic/wizard@1.3.0.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.