registry / momentic-mobile / 1.24.0
momentic-mobile@1.24.0
 [![npm]](https://www.npmjs.com/package/momentic-mobile)
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection found a bundled CLI with expected Momentic testing functionality and no lifecycle hook. The scanner's alleged redirect/overwrite chain was not substantiated by source inspection.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs a Momentic Mobile CLI command.
Impact
No unconsented install-time mutation, credential diversion, or exfiltration chain confirmed.
Mechanism
Explicit mobile testing, asset, and results-management commands.
AI rationale
Direct inspection found a bundled CLI with expected Momentic testing functionality and no lifecycle hook. The scanner's alleged redirect/overwrite chain was not substantiated by source inspection.
Evidence
package.jsonREADME.mdbin/cli.jsskills/momentic-mobile-test.md
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Manifest exposes only a user-invoked CLI entrypoint.
- CLI actions include explicit login, project initialization, asset download, and result upload.
Evidence against
- package.json has no lifecycle scripts.
- README identifies this as the official Momentic Mobile CLI.
- No source-confirmed credential redirect, foreign-package overwrite, or install-time execution was found.
- Network and filesystem operations are tied to named CLI commands for mobile testing.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
13 flaggedstatic/assets/vendor-Dqth9LKu.jsView file
20patternName = generic_password
severity = medium
line = 20
matchedText = Reason: ...ion.
Medium
Secret Pattern
Package contains a possible secret pattern.
static/assets/vendor-Dqth9LKu.jsView on unpkg · L20bin/cli.jsView file
29import { PostHog } from 'posthog-node';
L30: import * as w2e from 'child_process';
L31: import { execFile, execSync, exec, execFileSync } from 'child_process';
High
174Original error: ${n}
L175: `}async function b2({dryRun:t,operation:e}){try{return await e()}catch(n){throw new Error(Xye({err:n,dryRun:t}),{cause:n})}}function ta(t){return t instanceof Error?t:new Error(G(t...
L176: `).map((o,r)=>r>0?`${n}${o}`:o).join(`
...
L178: `).map((p,m)=>m>0?` ${p}`:p).join(`
L179: `)),i(" ",n(d));}}setMinLevel(e){typeof e=="string"?this.minLogLevel=cy[e]:this.minLogLevel=e;}setOutputStream(e){this.forcedStream=e;}log(...e){this.logWithLevel(30,La.reset,...e...
L180: `)){let[o,r]=n.trim().split(/\s+/,2);if(!o||!r)continue;let i=Number.parseInt(r,10);Number.isFinite(i)&&(e[o]=i);}return e}function rxe(t,e){let n,o,r;for(let i of e.split(`
L181: `)){let a=i.indexOf(":");if(a===-1)continue;let s=i.slice(0,a),l=i.slice(a+1).trim();if(s==="Name"&&(n=l),s==="PPid
Findings
9 High5 Medium7 Low
HighChild Processbin/cli.js
HighShellstatic/assets/index-t0tYbNKA.js
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighEntrypoint Foreign Package Code Overwritebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
HighSemantic Analysis Limitedbin/cli.js
MediumSecret Patternstatic/assets/vendor-Dqth9LKu.js
MediumDynamic Requirestatic/assets/index-t0tYbNKA.js
MediumNetwork
Medium
Affected versions and remediation
This report applies to momentic-mobile@1.24.0.
See all versions of momentic-mobile for other recorded verdicts.
- Review the evidence and your use of momentic-mobile@1.24.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.