momentic@3.58.2
⚠ Under review [![npm]](https://www.npmjs.com/package/momentic)
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 0.0% confidence. No malicious behavior was detected; 27 low-signal pattern(s) were surfaced and cleared.
Static reason
Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
bin/cli.js3.85 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVars
Source & flagged code
18 flaggedpackage.jsonView file
•name = momentic; similarTo = moment
Medium
Typosquat Name
Package name is suspiciously similar to a popular package name.
package.jsonView on unpkgstatic/assets/index-DhPK9B12.jsView file
12patternName = generic_password
severity = medium
line = 12
Medium
Secret Pattern
Package contains a possible secret pattern.
static/assets/index-DhPK9B12.jsView on unpkg · L12bin/cli.jsView file
13import q6 from 'truncate-json';
L14: import Yl, { supportsColorStderr, supportsColor, Chalk } from 'chalk';
L15: import nBe from 'safe-stable-stringify';
...
L30: import OU, { randomUUID, createHash, createHmac, timingSafeEqual } from 'crypto';
L31: import * as wmt from 'child_process';
L32: import { execFile, execSync, exec, spawnSync, execFileSync, spawn as spawn$1 } from 'child_process';
...
L37: import { registerInstrumentations } from '@opentelemetry/instrumentation';
L38: import { UndiciInstrumentation } from '@opentelemetry/instrumentation-undici';
L39: import { resourceFromAttributes } from '@opentelemetry/resources';
...
L172: Original error: ${o}
L173: `}async function F5({dryRun:e,operation:t}){try{return await t()}catch(o){throw new Error(DNe({err:o,dryRun:e}),{cause:o})}}
Findings
4 Critical12 High5 Medium6 Low
CriticalCredential Exfiltrationbin/cli.js
CriticalBrowser Credential Phishingbin/cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/cli.js
CriticalPrevious Version Dangerous Deltabin/cli.js
HighChild Processbin/cli.js
HighShell
HighSame File Env Network Executionbin/cli.js
HighCredential Redirect Persistencebin/cli.js
HighCommand Output Exfiltrationbin/cli.js
HighRemote Agent Bridgebin/cli.js
HighCross File Remote Execution Contextstatic/assets/test-VmSk6huB.js
HighTrigger Reachable Credential Exfiltrationbin/cli.js
Affected versions and remediation
This report applies to momentic@3.58.2.
See all versions of momentic for other recorded verdicts.
- Review the evidence and your use of momentic@3.58.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.