momentic@3.51.1
 [![npm]](https://www.npmjs.com/package/momentic)
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms an explicit-user-command agent-skill write, so it warrants a warning under policy. The scanner's credential-exfiltration and foreign-package-overwrite claims are not supported as malicious behavior by the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Run `momentic install-skills --editor <editor>` or `momentic login`.
Impact
May alter an opted-in project's AI-agent skill surface; login stores Momentic credentials locally.
Mechanism
Explicit CLI agent-skill installation and credential persistence.
AI rationale
Source inspection confirms an explicit-user-command agent-skill write, so it warrants a warning under policy. The scanner's credential-exfiltration and foreign-package-overwrite claims are not supported as malicious behavior by the inspected source.
Evidence
package.jsonbin/cli.jsskills/momentic-test.md.cursor/skills.claude/skills.agents/skills.opencode/skills.github/skills~/.momentic/auth.json
Network endpoints1
api.momentic.ai
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit install-skills command writes package skill content into selected AI-editor project directories.
- CLI can persist login credentials after the user invokes login.
Evidence against
- No npm lifecycle scripts are declared.
- Skill installation requires the explicit install-skills command and mandatory editor selection.
- Credential storage is confined to ~/.momentic/auth.json with restrictive modes.
- Default service endpoint is api.momentic.ai; no fixed unofficial credential gateway was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
17 flaggedpackage.jsonView file
•name = momentic; similarTo = moment
Medium
Typosquat Name
Package name is suspiciously similar to a popular package name.
package.jsonView on unpkgbin/cli.jsView file
11import XJ from 'truncate-json';
L12: import Dl, { supportsColorStderr, supportsColor, Chalk } from 'chalk';
L13: import GLe from 'safe-stable-stringify';
...
L30: import kB, { randomUUID, createHash, createHmac, timingSafeEqual } from 'crypto';
L31: import * as nit from 'child_process';
L32: import { execFile, execSync, exec, execFileSync, spawn as spawn$1 } from 'child_process';
...
L37: import { registerInstrumentations } from '@opentelemetry/instrumentation';
L38: import { UndiciInstrumentation } from '@opentelemetry/instrumentation-undici';
L39: import { resourceFromAttributes } from '@opentelemetry/resources';
...
L159: Use this only after the available tools cannot establish a defensible root cause. Do not use OTHER while targeted current-run step results, container screenshots,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
bin/cli.jsView on unpkg · L11Findings
4 Critical11 High4 Medium6 Low
CriticalCredential Exfiltrationbin/cli.js
CriticalBrowser Credential Phishingbin/cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/cli.js
CriticalPrevious Version Dangerous Deltabin/cli.js
HighChild Processbin/cli.js
HighShellstatic/assets/index-zUHNsHzW.js
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighEntrypoint Foreign Package Code Overwritebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighRemote Agent Bridgebin/cli.js
HighTrigger Reachable Credential Exfiltration
Affected versions and remediation
This report applies to momentic@3.51.1.
See all versions of momentic for other recorded verdicts.
- Review the evidence and your use of momentic@3.51.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.