momentic@3.45.0
 [![npm]](https://www.npmjs.com/package/momentic)
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection found no lifecycle hook or concrete credential-exfiltration behavior. Scanner hits stem from a bundled testing CLI that intentionally handles test cookies, API keys, browser control, and package-aligned telemetry.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Explicit execution of the momentic CLI.
Impact
No unconsented install-time execution, credential harvesting, or exfiltration chain was established.
Mechanism
User-directed browser testing, cloud API access, and telemetry.
AI rationale
Direct inspection found no lifecycle hook or concrete credential-exfiltration behavior. Scanner hits stem from a bundled testing CLI that intentionally handles test cookies, API keys, browser control, and package-aligned telemetry.
Evidence
package.jsonREADME.mdbin/cli.jsskills/momentic-test.mdskills/momentic-mobile-test.md
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- bin/cli.js includes user-invoked browser test automation and cloud telemetry/API clients.
- bin/cli.js contains Momentic API, PostHog, Sentry, and metrics endpoints.
Evidence against
- package.json has no lifecycle scripts.
- bin/cli.js is the explicit CLI bin entrypoint, not install-time code.
- README.md identifies it as the official Momentic E2E-testing CLI.
- bin/cli.js denies reads of .env, .npmrc, SSH keys, certificates, and credential files.
- Browser cookies/storage are test-session features; no browser-profile credential harvesting was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
Source & flagged code
15 flaggedpackage.jsonView file
•name = momentic; similarTo = moment
Medium
Typosquat Name
Package name is suspiciously similar to a popular package name.
package.jsonView on unpkgbin/cli.jsView file
11import fY from 'truncate-json';
L12: import Ol, { supportsColorStderr, supportsColor, Chalk } from 'chalk';
L13: import GPe from 'safe-stable-stringify';
...
L30: import hF, { randomUUID, createHash, createHmac, timingSafeEqual } from 'crypto';
L31: import * as rXe from 'child_process';
L32: import { execFile, execSync, exec, execFileSync, spawn as spawn$1 } from 'child_process';
...
L37: import { registerInstrumentations } from '@opentelemetry/instrumentation';
L38: import { UndiciInstrumentation } from '@opentelemetry/instrumentation-undici';
L39: import { resourceFromAttributes } from '@opentelemetry/resources';
...
L160: Use this only after the available tools cannot establish a defensible root cause. Do not use OTHER while targeted current-run step results, container screenshots,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
bin/cli.jsView on unpkg · L11Findings
4 Critical9 High5 Medium7 Low
CriticalCredential Exfiltrationbin/cli.js
CriticalBrowser Credential Phishingbin/cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/cli.js
CriticalPrevious Version Dangerous Deltabin/cli.js
HighChild Processbin/cli.js
HighShellstatic/assets/index-DOoCNNMu.js
HighSame File Env Network Executionbin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighRemote Agent Bridgebin/cli.js
HighTrigger Reachable Credential Exfiltrationbin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
HighRuntime Package Install
Affected versions and remediation
This report applies to momentic@3.45.0.
See all versions of momentic for other recorded verdicts.
- Review the evidence and your use of momentic@3.45.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.