@momentic/wizard@1.8.3
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe CLI supports an advanced server override and sends the API key to it during onboarding, creating conditional credential exposure to an untrusted configured endpoint. The source does not establish covert theft or another concrete attack, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the wizard through onboarding with a non-default server configured.
Impact
The configured server receives the API key, which could expose it if the operator selects an untrusted endpoint.
Mechanism
The onboarding completion request uses the configured server URL and includes the API key as a bearer credential.
AI rationale
The CLI supports an advanced server override and sends the API key to it during onboarding, creating conditional credential exposure to an untrusted configured endpoint. The source does not establish covert theft or another concrete attack, so this warrants a warning rather than a block.
Evidence
bin/cli.js
Network endpoints1
api.momentic.ai
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI accepts a caller-selected server through --server or MOMENTIC_SERVER, with the Momentic API as its default.
- The onboarding completion request sends the API key as a bearer credential to the selected server.
- The CLI is a project setup wizard exposed as a command, with no package lifecycle hooks shown in the manifest.
Evidence against
- The credential-bearing request is part of onboarding and uses the selected API server; the inspected source does not show a hidden default recipient or a malicious payload.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
6 flaggedbin/cli.jsView file
22import D8 from 'open';
L23: import { spawn, spawnSync, execFileSync } from 'child_process';
L24: import { getUserAgent, detect, resolveCommand } from 'package-manager-detector';
High
206`)?u:`${u}
L207: `}function R8(e,t){let r=ye.join(ye.dirname(e),`.${ye.basename(e)}.${process.pid}.tmp`),n=So__default.existsSync(e)?So__default.statSync(e).mode:void 0;try{So__default.writeFileSyn...
L208: This usually means your machine or network intercepts HTTPS traffic (corporate proxy, firewall, or antivirus).
...
L221: `))n&&console.info(`\u2502 ${n}`);},success(r){console.info(`\u2714 ${r}`);},error(r){console.info(`\u2716 ${r}`);}}}};var yU=new Xa({debug:false});function ee(){return yU}funct...
L222: `;So__default.writeSync(this.handle,r);}catch{}}close(){if(this.handle!==void 0)try{So__default.closeSync(this.handle);}catch{}}},TU=new df("",void 0);function AU(){let e=ye.join(w...
L223: ${g}`,code:"ETIMEDOUT",tailOutput:g});Lt().append({event:"spawn:timeout",command:e.com
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L206•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/cli.js:
`)),a(" ",r(m));}}setMinLevel(t){typeof t=="string"?this.minLogLevel=WM[t]:this.minLogLevel=t;}setOutputStream(t){this.forcedStream=t;}log(...t){this.logWithLevel(30,ue.reset,...t...
`)||e.includes("\r")||e.includes("{{")||e.includes("}}")||e.length===0||!e.toLowerCase().endsWith(".json"))}function oe(e){return Object.fromEntries(Object.entries(e).filter(([,t])...
`);function yn(e,t,{commentBefore:r,comment:n}){let o=e.items.find(a=>Ht.isPair(a)&&Ht.isScalar(a.key)&&a.key.value===t);if(o&&(r!==void 0&&Ht.isScalar(o.key)&&(o.key.commentBefore...
`);if(a===-1)continue;let s=o.slice(0,a),c=o.slice(a+1).trim();n[s]=c;}return n
Findings
7 High3 Medium6 Low
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @momentic/wizard@1.8.3.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.8.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.