@momentic/wizard@1.4.0
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not concrete malware: there are no lifecycle hooks, hidden payload execution, or unconsented install-time mutation. The CLI nonetheless changes global AI-agent configuration and installs global skills, so policy requires a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs momentic-wizard and selects editor-tool setup, including non-interactive defaults.
Impact
Adds a Momentic-controlled command to agent configuration, creating a user-approved but persistent agent capability.
Mechanism
Global agent configuration mutation and npx-based skills installation.
AI rationale
This is not concrete malware: there are no lifecycle hooks, hidden payload execution, or unconsented install-time mutation. The CLI nonetheless changes global AI-agent configuration and installs global skills, so policy requires a warning.
Evidence
bin/cli.js~/.codeium/windsurf/mcp_config.json~/.config/opencode/opencode.json~/Library/Application Support/Claude/claude_desktop_config.json~/.gemini/config/mcp_config.json
Network endpoints2
api.momentic.airegistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-invoked wizard can add a Momentic MCP server entry to existing agent configuration files.
- The wizard offers an option that invokes npx to install Momentic skills globally.
- The wizard sends an authenticated onboarding completion request to the configured Momentic API server.
Evidence against
- package.json has no preinstall, install, postinstall, or other lifecycle hook.
- The risky actions are reached through the CLI wizard and its editor-tools selection, not package installation.
- The inspected fetch and base64 uses do not decode and execute remote code; the base64 value is a Cursor deeplink configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
8 flaggedbin/cli.jsView file
157`),WJ=[" Run tests on Momentic hosted browsers instead of local Chromium."," Use this in CI to run tests in parallel without adding machines. See https://momentic.ai/docs/running-t...
L158: `);function dn(e,t,{commentBefore:r,comment:i}){let o=e.items.find(a=>$t.isPair(a)&&$t.isScalar(a.key)&&a.key.value===t);if(o&&(r!==void 0&&$t.isScalar(o.key)&&(o.key.commentBefore...
L159: `);if(a===-1)continue;let s=o.slice(0,a),c=o.slice(a+1).trim();i[s]=c;}return i}function Yc(e){if(e.startsWith("git@")){let t=e.split(":");if(t.length===2){let r=t[1].replace(".git...
...
L172: ${o.code(fN(d,i))}`,a),t)try{await UX(d);}catch{e.warn(`Could not open a browser automatically. Paste ${o.code(d)} manually.`);}let h=e.spinner();h.start(s);try{let g=await u$({cli...
L173: `))i&&console.info(`\u2502 ${
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
bin/cli.jsView on unpkg · L157157Trigger-reachable chain: manifest.bin -> bin/cli.js
L157: `),WJ=[" Run tests on Momentic hosted browsers instead of local Chromium."," Use this in CI to run tests in parallel without adding machines. See https://momentic.ai/docs/running-t...
L158: `);function dn(e,t,{commentBefore:r,comment:i}){let o=e.items.find(a=>$t.isPair(a)&&$t.isScalar(a.key)&&a.key.value===t);if(o&&(r!==void 0&&$t.isScalar(o.key)&&(o.key.commentBefore...
L159: `);if(a===-1)continue;let s=o.slice(0,a),c=o.slice(a+1).trim();i[s]=c;}return i}function Yc(e){if(e.startsWith("git@")){let t=e.split(":");if(t.length===2){let r=t[1].replace(".git...
...
L172: ${o.code(fN(d,i))}`,a),t)try{await UX(d);}catch{e.warn(`Could not open a browser automatically. Paste ${o.code(d)} manually.`);}let h=e.spinner();h.start(s);try{let g=a
Findings
2 Critical7 High3 Medium5 Low
CriticalRemote Asset Decode Executebin/cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/cli.js
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @momentic/wizard@1.4.0.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.