@momentic/wizard@1.8.2
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe CLI can forward a WorkOS access token to an operator-configured server, creating a conditional credential exposure risk. The behavior is user-invoked and the package has no install lifecycle hook, so this warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the login or setup command and configures a non-default server.
Impact
A user who directs login to an untrusted server may expose the WorkOS token. No automatic install-time attack was identified.
Mechanism
The login flow posts a WorkOS access token to the selected server for exchange; the wizard can also write a Momentic MCP entry into selected agent configuration.
AI rationale
The CLI can forward a WorkOS access token to an operator-configured server, creating a conditional credential exposure risk. The behavior is user-invoked and the package has no install lifecycle hook, so this warrants a warning rather than a publish block.
Evidence
bin/cli.js
Network endpoints2
api.momentic.aiapi.workos.com
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The published CLI entrypoint exposes an advanced server override with a package-aligned default.
- The login flow sends a WorkOS access token to the selected server for exchange.
- The wizard can add Momentic MCP configuration to coding-agent files after user selection.
Evidence against
- The manifest declares no install lifecycle scripts; the behavior is reached through the CLI.
- The coding-agent setup is user-selected and writes a Momentic MCP entry.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
6 flaggedbin/cli.jsView file
22import $8 from 'open';
L23: import { spawn, spawnSync, execFileSync } from 'child_process';
L24: import { getUserAgent, detect, resolveCommand } from 'package-manager-detector';
High
206`)?u:`${u}
L207: `}function I8(e,t){let r=ye.join(ye.dirname(e),`.${ye.basename(e)}.${process.pid}.tmp`),n=So__default.existsSync(e)?So__default.statSync(e).mode:void 0;try{So__default.writeFileSyn...
L208: This usually means your machine or network intercepts HTTPS traffic (corporate proxy, firewall, or antivirus).
...
L221: `))n&&console.info(`\u2502 ${n}`);},success(r){console.info(`\u2714 ${r}`);},error(r){console.info(`\u2716 ${r}`);}}}};var gU=new Xa({debug:false});function ee(){return gU}funct...
L222: `;So__default.writeSync(this.handle,r);}catch{}}close(){if(this.handle!==void 0)try{So__default.closeSync(this.handle);}catch{}}},vU=new df("",void 0);function xU(){let e=ye.join(O...
L223: ${g}`,code:"ETIMEDOUT",tailOutput:g});Lt().append({event:"spawn:timeout",command:e.com
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L206•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/cli.js:
`)),a(" ",r(m));}}setMinLevel(t){typeof t=="string"?this.minLogLevel=WM[t]:this.minLogLevel=t;}setOutputStream(t){this.forcedStream=t;}log(...t){this.logWithLevel(30,ue.reset,...t...
`)||e.includes("\r")||e.includes("{{")||e.includes("}}")||e.length===0||!e.toLowerCase().endsWith(".json"))}function oe(e){return Object.fromEntries(Object.entries(e).filter(([,t])...
`);function yn(e,t,{commentBefore:r,comment:n}){let o=e.items.find(a=>Ht.isPair(a)&&Ht.isScalar(a.key)&&a.key.value===t);if(o&&(r!==void 0&&Ht.isScalar(o.key)&&(o.key.commentBefore...
`);if(a===-1)continue;let s=o.slice(0,a),c=o.slice(a+1).trim();n[s]=c;}return n
Findings
7 High3 Medium6 Low
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @momentic/wizard@1.8.2.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.8.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.