momentic@3.52.11
 [![npm]](https://www.npmjs.com/package/momentic)
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection found a large test-automation CLI and bundled web assets, but no automatic install execution or concrete malicious behavior. Scanner credential matches are explained by explicit CLI authentication and password-masking replay code.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An explicit user invocation of the momentic command.
Impact
No covert credential theft, destructive action, or unauthorized persistence was confirmed.
Mechanism
User-invoked testing CLI with configured API access.
AI rationale
Static inspection found a large test-automation CLI and bundled web assets, but no automatic install execution or concrete malicious behavior. Scanner credential matches are explained by explicit CLI authentication and password-masking replay code.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a command-line entry point.
- The command-line program accepts an API key from an environment variable or its own authentication file.
- The bundled web code configures session replay to mask password inputs.
Evidence against
- The manifest has no lifecycle scripts, so installation does not automatically run package code.
- The examined network configuration targets Momentic service endpoints or opt-in telemetry, not an unrelated credential receiver.
- The CLI's key and server settings are command options for the invoked product; no covert credential harvesting or exfiltration path was found.
- The browser bundle's password-related code masks values rather than collecting them.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
15 flaggedpackage.jsonView file
•name = momentic; similarTo = moment
Medium
Typosquat Name
Package name is suspiciously similar to a popular package name.
package.jsonView on unpkgbin/cli.jsView file
13import AX from 'truncate-json';
L14: import $l, { supportsColorStderr, supportsColor, Chalk } from 'chalk';
L15: import bDe from 'safe-stable-stringify';
...
L30: import xB, { randomUUID, createHash, createHmac, timingSafeEqual } from 'crypto';
L31: import * as ult from 'child_process';
L32: import { execFile, execSync, exec, execFileSync, spawn as spawn$1 } from 'child_process';
...
L37: import { registerInstrumentations } from '@opentelemetry/instrumentation';
L38: import { UndiciInstrumentation } from '@opentelemetry/instrumentation-undici';
L39: import { resourceFromAttributes } from '@opentelemetry/resources';
...
L171: Original error: ${n}
L172: `}async function d4({dryRun:e,operation:t}){try{return await t()}catch(n){throw new Error(tke({err:n,dryRun:e}),{cause:n})}}function Qr
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
bin/cli.jsView on unpkg · L13Findings
3 Critical10 High4 Medium6 Low
CriticalCredential Exfiltrationbin/cli.js
CriticalBrowser Credential Phishingbin/cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/cli.js
HighChild Processbin/cli.js
HighShellstatic/assets/index-ClehBQBI.js
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighRemote Agent Bridgebin/cli.js
HighTrigger Reachable Credential Exfiltrationbin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js
HighRuntime Package Install
Affected versions and remediation
This report applies to momentic@3.52.11.
See all versions of momentic for other recorded verdicts.
- Review the evidence and your use of momentic@3.52.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.