registry / momentic-mobile / 1.27.1
momentic-mobile@1.27.1
 [![npm]](https://www.npmjs.com/package/momentic-mobile)
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection found a bundled, user-invoked testing CLI with no lifecycle hooks. Scanner claims of credential redirection and foreign-package overwrite were not substantiated by source inspection.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs a momentic-mobile CLI subcommand.
Impact
No unconsented install-time mutation, credential exfiltration, or foreign-package overwrite found.
Mechanism
Mobile-test orchestration and Momentic API access.
AI rationale
Direct inspection found a bundled, user-invoked testing CLI with no lifecycle hooks. Scanner claims of credential redirection and foreign-package overwrite were not substantiated by source inspection.
Evidence
package.jsonREADME.mdbin/cli.js
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- Manifest exposes a CLI bin and declares no lifecycle scripts.
- README identifies it as the official Momentic Mobile CLI.
- CLI actions run only after explicit subcommands.
Evidence against
- CLI handles API keys, network requests, local files, and mobile-test tooling.
- Telemetry and Momentic service endpoints are present during CLI use.
- No foreign package overwrite, credential redirection, or install-time execution was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
13 flaggedbin/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = momentic-mobile@1.25.0
matchedIdentity = npm:bW9tZW50aWMtbW9iaWxl:1.25.0
similarity = 0.700
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg29import { PostHog } from 'posthog-node';
L30: import * as WWe from 'child_process';
L31: import { execFile, execSync, exec, execFileSync } from 'child_process';
High
174Original error: ${n}
L175: `}async function lH({dryRun:t,operation:e}){try{return await e()}catch(n){throw new Error(ITe({err:n,dryRun:t}),{cause:n})}}function Bi(t){return t instanceof Error?t:new Error(W(t...
L176: `).map((o,r)=>r>0?`${n}${o}`:o).join(`
...
L178: `).map((m,p)=>p>0?` ${m}`:m).join(`
L179: `)),i(" ",n(d));}}setMinLevel(e){typeof e=="string"?this.minLogLevel=Ry[e]:this.minLogLevel=e;}setOutputStream(e){this.forcedStream=e;}log(...e){this.logWithLevel(30,Fa.reset,...e...
L180: `)){let[o,r]=n.trim().split(/\s+/,2);if(!o||!r)continue;let i=Number.parseInt(r,10);Number.isFinite(i)&&(e[o]=i);}return e}function e_e(t,e){let n,o,r;for(let i of e.split(`
L181: `)){let a=i.indexOf(":");if(a===-1)continue;let s=i.slice(0,a),l=i.slice(a+1).trim();if(s==="Name"&&(n=l),s==="PPid
Findings
1 Critical9 High4 Medium7 Low
CriticalPrevious Version Dangerous Deltabin/cli.js
HighChild Processbin/cli.js
HighShellstatic/assets/index-DKp6i8N6.js
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighEntrypoint Foreign Package Code Overwritebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
HighSemantic Analysis Limitedbin/cli.js
MediumDynamic Requirestatic/assets/index-DKp6i8N6.js
MediumNetwork
Affected versions and remediation
This report applies to momentic-mobile@1.27.1.
See all versions of momentic-mobile for other recorded verdicts.
- Review the evidence and your use of momentic-mobile@1.27.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.