registry / momentic-mobile / 1.4.3
momentic-mobile@1.4.3
 [![npm]](https://www.npmjs.com/package/momentic-mobile)
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
bin/cli.js2.22 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVars
Source & flagged code
4 flaggedstatic/assets/vendor-D7bnEeEF.jsView file
20patternName = generic_password
severity = medium
line = 20
matchedText = Reason: ...ion.
Medium
Secret Pattern
Package contains a possible secret pattern.
static/assets/vendor-D7bnEeEF.jsView on unpkg · L20static/assets/index-D3uKBoA4.jsView file
8585* import { SimpleFaker } from '@faker-js/faker';
L8586: * // const { SimpleFaker } = require('@faker-js/faker');
L8587: *
Medium
Dynamic Require
Package source references dynamic require/import behavior.
static/assets/index-D3uKBoA4.jsView on unpkg · L8585bin/cli.jsView file
•
Findings
1 High6 Medium7 Low
HighOversized Source Filebin/cli.js
MediumSecret Patternstatic/assets/vendor-D7bnEeEF.js
MediumDynamic Requirestatic/assets/index-D3uKBoA4.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Cli Entrypointbin/cli.js
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to momentic-mobile@1.4.3.
See all versions of momentic-mobile for other recorded verdicts.
- Review the evidence and your use of momentic-mobile@1.4.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.