registry / Credential exfiltration / @reason-machines/cli-darwin-arm64
@reason-machines/cli-darwin-arm64
Reason CLI native binary for darwin-arm64
This report shows the evidence for @reason-machines/cli-darwin-arm64@0.2.434. 10 of 322 known versions are blocked or flagged. The newest version, 0.2.547, is allowed. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe inspected native CLI source shows an active path from existing third-party login stores to the Reason local-subscription request, enabled by default. Disclosure and exclusion of refresh tokens do not provide recipient-specific consent for forwarding those credentials.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Starting the worker while the default local-login setting is enabled.
Impact
The Reason service receives credentials that can grant access to the corresponding provider accounts until those tokens expire or are revoked.
Mechanism
The CLI reads provider login stores, collects current access tokens, and includes them in a request to the local-subscription endpoint.
Attack narrative
When the Reason worker starts, its default-enabled local-login handover reads existing Claude, Codex, and Grok login credentials and sends current access tokens to the Reason API. The built-in help discloses the feature, but the source does not show a recipient-specific affirmative consent gate. This exposes third-party account credentials to the Reason service.
AI rationale
The inspected native CLI source shows an active path from existing third-party login stores to the Reason local-subscription request, enabled by default. Disclosure and exclusion of refresh tokens do not provide recipient-specific consent for forwarding those credentials.
Evidence
.lpm-inspection-9jsn5W/0-7e04a66c25af.txt~/.claude/.credentials.json~/.codex/auth.json~/.grok/auth.json
Network endpoints1
Reason API /local-subscription
Decision evidence
public snapshotAI called this Malicious at 92.0% confidence as Malware with low false-positive risk.
Evidence for block
- Embedded CLI code reads existing provider login stores and extracts Anthropic and OpenAI access tokens.
- When local login handover runs, it passes each provider access token to the client's local-subscription request.
- The setting defaults to enabled, and the worker startup path runs handover when it is enabled.
- Built-in help discloses that Reason receives current access tokens and says the feature is on by default; it does not establish recipient-specific consent.
- The flagged sandbox source lists protected Claude command and agent paths; the credential transfer is in the native CLI artifact analysis.
Evidence against
- Built-in help discloses the token sharing and says refresh tokens are not transferred.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(s)=>{C(`Client request error: ${s.message}`,{level:"error"})}),i.on("error",(s)=>{C(`Client response error: ${s.message}`,{level:"er...
L57: `)),e.end(cx(a))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(a)=>{e.off("data",s),clearTimeout(i),t(a)...
...
L60: mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
5 High3 Medium4 Low
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighKnown Malware Source Similaritybin/runtime/srt/sandbox-runtime.mjs
HighAi Review Evidencebin/runtime/srt/sandbox-runtime.mjs
MediumEnvironment Vars
MediumShips Native Binarybin/Background/Reason.app/Contents/MacOS/ReasonBackgroundIdentity
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @reason-machines/cli-darwin-arm64@0.2.434.
The versions list below shows the verdict for each recorded version.
- Avoid installing @reason-machines/cli-darwin-arm64@0.2.434. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.