@momentic/wizard@1.9.1
Onboarding wizard for setting up Momentic end-to-end testing in your project.
AI Security Review
scanned 16h ago · by lpm-firewall-aiThe CLI performs undisclosed runtime telemetry to its vendor, including machine metadata and potentially sensitive command output in failure reports. The credential requests reviewed target the configured Momentic service, so the evidence supports a telemetry warning rather than credential exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the momentic-wizard CLI; command output is included on certain failure events.
Impact
The vendor receives identifying account metadata and diagnostic output that may contain sensitive information.
Mechanism
The CLI captures events with PostHog at p.momentic.ai and attaches runtime metadata and, for failures, a truncated output tail.
AI rationale
The CLI performs undisclosed runtime telemetry to its vendor, including machine metadata and potentially sensitive command output in failure reports. The credential requests reviewed target the configured Momentic service, so the evidence supports a telemetry warning rather than credential exfiltration.
Evidence
bin/cli.js
Network endpoints1
p.momentic.ai
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Invoking the manifest's momentic-wizard binary runs bin/cli.js, which sends runtime events to the package's PostHog endpoint at p.momentic.ai without a visible consent check.
- Telemetry includes OS release, architecture, Node version, shell, npm user agent, CI status, lockfile names, and account identifiers.
- On package-manager failures, telemetry can include a truncated command output tail.
Evidence against
- The package is an onboarding CLI, and its API-key requests go to the configured Momentic server as part of sign-in and setup.
- package.json declares no lifecycle scripts, so the reviewed telemetry is triggered when the CLI is run rather than during installation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
6 flaggedbin/cli.jsView file
23import Sie from 'open';
L24: import { spawn, spawnSync, execFileSync } from 'child_process';
L25: import { getUserAgent, detect, resolveCommand } from 'package-manager-detector';
High
207`)?l:`${l}
L208: `}function sie(e,t){let r=xe.join(xe.dirname(e),`.${xe.basename(e)}.${process.pid}.tmp`),i=Mn__default.existsSync(e)?Mn__default.statSync(e).mode:void 0;try{Mn__default.writeFileSy...
L209: This usually means your machine or network intercepts HTTPS traffic (corporate proxy, firewall, or antivirus).
...
L222: `))i&&console.info(`\u2502 ${i}`);},success(r){console.info(`\u2714 ${r}`);},error(r){console.info(`\u2716 ${r}`);}}}};var FB=new Fs({debug:false});function Q(){return FB}functi...
L223: `;Mn__default.writeSync(this.handle,r);}catch{}}close(){if(this.handle!==void 0)try{Mn__default.closeSync(this.handle);}catch{}}},ZB=new Qh("",void 0);function YB(){let e=xe.join(r...
L224: ${m}`,code:"ETIMEDOUT",tailOutput:m});Ht().append({event:"spawn:timeout",command:e.com
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L207•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/cli.js:
`,action:"fail"}];var zK="warn",DK="pull-request",sE=(i=>(i.COMMIT_TO_SOURCE="commit-to-source",i.ROUTE_TO_OWNER="route-to-owner",i.ALREADY_FIXED="already-fixed",i))(sE||{}),UK=["c...
`)),a(" ",r(d));}}setMinLevel(t){typeof t=="string"?this.minLogLevel=H$[t]:this.minLogLevel=t;}setOutputStream(t){this.forcedStream=t;}log(...t){this.logWithLevel(30,de.reset,...t...
`)||e.includes("\r")||e.includes("{{")||e.includes("}}")||e.length===0||!e.toLowerCase().endsWith(".json"))}function re(e){return Object.fromEntries(Object.entries(e).filter(([,t])...
`);function Do(e,t,{commentBefore:r,comment:i}){let n=e.items.find(a=>rn.isPair
Findings
7 High3 Medium6 Low
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @momentic/wizard@1.9.1.
See all versions of @momentic/wizard for other recorded verdicts.
- Review the evidence and your use of @momentic/wizard@1.9.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.