registry / momentic-mobile / 1.41.4
momentic-mobile@1.41.4
The official CLI for Momentic Mobile. Build, run, and manage end-to-end tests for iOS and Android through natural language prompts.
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection resolved the credential-redirection hint as server selection for the CLI’s account request, and the diagnostics path has an explicit sharing gate. The manifest and required source paths did not establish malicious behavior, so the scanner’s static signals do not support a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the CLI; diagnostic export requires the user to enable its sharing option.
Impact
No malicious impact was established from these behaviors.
Mechanism
The inspected account flow selects Momentic’s API by default and preserves an explicitly selected server. Run diagnostics are enabled only when the sharing option is true.
AI rationale
Source inspection resolved the credential-redirection hint as server selection for the CLI’s account request, and the diagnostics path has an explicit sharing gate. The manifest and required source paths did not establish malicious behavior, so the scanner’s static signals do not support a block.
Network endpoints1
api.momentic.ai
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest exposes the CLI entrypoint and declares no npm lifecycle hook.
- The CLI selects Momentic’s API for the default server and uses an explicitly selected server when provided; the inspected caller uses that base URL to fetch account information.
- Run diagnostics export is controlled by an explicit option and is enabled only when the option is true.
- The required bundles and prepared dependencies include frontend assets, model-provider modules, and a package-manager utility; their inspected source did not establish an attack.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
12 flaggedbin/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = momentic-mobile@1.40.0
matchedIdentity = npm:bW9tZW50aWMtbW9iaWxl:1.40.0
similarity = 0.455
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg32import { PostHog } from 'posthog-node';
L33: import * as amt from 'child_process';
L34: import { execFile, execSync, execFileSync, exec } from 'child_process';
High
187L188: What the agent did: ${r}`:e}var bE=ts.extend({type:z.literal("AI_ACTION_DYNAMIC"),text:z.string(),effort:Rt.optional(),retries:z.number().optional(),version:gE.optional(),cache:Qz....
L189: `).map((r,n)=>n>0?`${o}${r}`:r).join(`
...
L195: `)}`;}o.required===false&&(n=n.nullable(),i+=`
L196: Use null when unknown or not applicable.`),e[o.name]=n.describe(i);}return z.strictObject(e)}function yze(t){let e=[t.testCases??[],t.bugReproductions??[]].map(o=>z.toJSONSchema(bz...
L197: `)){let[r,n]=o.trim().split(/\s+/,2);if(!r||!n)continue;let i=Number.parseInt(n,10);Number.isFinite(i)&&(e[r]=i);}return e}function sHe(t,e){let o,r,n;for(let i of e.split(`
L198: `)){let a=i.indexOf(":");if(a===-1)continue;let s=i.slice(0,a),l=i.slice(a+1).trim();if(s==="Name"&&(o=l),s==="PPid"&&(r=Numb
Findings
1 Critical10 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltabin/cli.js
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighCloud Metadata Accessbin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
HighTrigger Reachable External Post Callbackbin/cli.js
HighSemantic Analysis Limitedbin/cli.js
MediumDynamic Requirebin/cli.js
Medium
Affected versions and remediation
This report applies to momentic-mobile@1.41.4.
See all versions of momentic-mobile for other recorded verdicts.
- Review the evidence and your use of momentic-mobile@1.41.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.