registry / momentic-mobile / 1.32.8
momentic-mobile@1.32.8
 [![npm]](https://www.npmjs.com/package/momentic-mobile)
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource shows an official user-invoked mobile test CLI with no npm lifecycle hooks; scanner-flagged domains and eval/network primitives are product, faker, or telemetry code. Remaining risk is first-party agent skill/MCP setup and dual-use local command execution, which policy treats as a warn rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs the momentic-mobile CLI (init, app, run, login, or skills/MCP setup), not npm install.
Impact
Momentic skill pointers and optional MCP entries are added to project or user agent configs; API keys are stored under ~/.momentic and sent to Momentic and WorkOS.
Mechanism
First-party coding-agent skill and MCP config installation
AI rationale
Source shows an official user-invoked mobile test CLI with no npm lifecycle hooks; scanner-flagged domains and eval/network primitives are product, faker, or telemetry code. Remaining risk is first-party agent skill/MCP setup and dual-use local command execution, which policy treats as a warn rather than a publish block.
Evidence
bin/cli.jsskills/manifest.jsonskills/momentic-mobile-test/SKILL.md~/.momentic/auth.json~/.momentic/skills.json.claude/skills.cursor/skills.cursor/rules/momentic-skills.mdc.agents/skills.github/skills.opencode/skillsCLAUDE.mdAGENTS.md.mcp.json.cursor/mcp.json
Network endpoints6
api.momentic.aiapi.workos.comp.momentic.aiipecho.net/plainingest.us.signoz.cloud:443/logs/jsonregistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package ships first-party Momentic skills for Claude Code, Cursor, Codex, Copilot, and OpenCode and installs them into those agents' project skill directories after a CLI confirm that defaults to yes.
- Skill install also writes always-on pointer files such as CLAUDE.md and AGENTS.md, and a separate path can add a Momentic MCP server (optionally with MOMENTIC_API_KEY) to many agent config files.
- The user-run CLI imports child_process exec/execSync and evaluates customer test JavaScript with child_process, axios, and pg in scope.
- Login stores API keys and server URL under ~/.momentic/auth.json and talks to WorkOS plus api.momentic.ai.
Evidence against
- package.json has no preinstall, install, or postinstall scripts; the only published entry is the momentic-mobile bin CLI.
- README and homepage present this as the official Momentic Mobile end-to-end test CLI, matching the bundled editor, Appium/device code, and api.momentic.ai client.
- Scanner-flagged hosts such as remarkable-hackwork.info and www.terrible-idea.com are faker.js examples in static UI, not live callbacks.
- There is no runtime self-dependency on another momentic-mobile release and no npm lifecycle mutation of foreign agent configs.
Source & flagged code
10 flaggedbin/cli.jsView file
31import { PostHog } from 'posthog-node';
L32: import * as P5e from 'child_process';
L33: import { execFile, execSync, execFileSync, exec } from 'child_process';
High
177L178: What the agent did: ${r}`:e}var dS=Ki.extend({type:z.literal("AI_ACTION_DYNAMIC"),text:z.string(),effort:et.optional(),retries:z.number().optional(),version:sN.optional(),cache:lN....
L179: `).map((r,n)=>n>0?`${o}${r}`:r).join(`
...
L181: `).map((d,p)=>p>0?` ${d}`:d).join(`
L182: `)),i(" ",o(m));}}setMinLevel(e){typeof e=="string"?this.minLogLevel=AS[e]:this.minLogLevel=e;}setOutputStream(e){this.forcedStream=e;}log(...e){this.logWithLevel(30,Xa.reset,...e...
L183: `)){let[r,n]=o.trim().split(/\s+/,2);if(!r||!n)continue;let i=Number.parseInt(n,10);Number.isFinite(i)&&(e[r]=i);}return e}function nLe(t,e){let o,r,n;for(let i of e.split(`
L184: `)){let a=i.indexOf(":");if(a===-1)continue;let s=i.slice(0,a),l=i.slice(a+1).trim();if(s==="Name"&&(o=l),s==="PPid"&&(r=Number.parseIn
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L177•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/cli.js:
import Io__default, { statSync, readFileSync, existsSync, readdir, readdirSync, mkdirSync, writeFileSync, rmSync, appendFileSync, watch, unlinkSync, renameSync } from 'fs';
import X6e from 'readline';
import { createInterface } from 'node:readline';
import oL, { mkdtemp, writeFile, rm, stat, readFile, readdir as readdir$1, unlink } from 'fs/promises';
`)),i(" ",o(m));}}setMinLevel(e){typeof e=="string"?this.minLogLevel=AS[e]:this.minLogLevel=e;}setOutputStream(e){this.forcedStream=e;}log(...e){this.logWithLevel(30,Xa.reset,...e...
`)}var ZX=["0-mail.com","0-mailer.dynv6.net","000-webmail.myhome-server.de","000000000000000.
Findings
9 High3 Medium7 Low
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
HighTrigger Reachable External Post Callbackbin/cli.js
HighSemantic Analysis Limitedbin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEvalbin/cli.js
LowWeak Cryptobin/cli.js
Affected versions and remediation
This report applies to momentic-mobile@1.32.8.
See all versions of momentic-mobile for other recorded verdicts.
- Review the evidence and your use of momentic-mobile@1.32.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.