@reason-machines/cli-darwin-arm64@0.2.376
Reason CLI native binary for darwin-arm64
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe native CLI has a default active path that transfers saved third-party access tokens to the product API without recipient-specific affirmative consent. The sandbox-runtime similarity and process-execution signals are not the basis for this decision.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Starting a worker while local logins are enabled, which is the default when the setting is omitted.
Impact
The Reason service receives usable current access tokens for third-party coding-tool accounts; refresh tokens are omitted.
Mechanism
The CLI reads saved credentials and repeatedly sends records containing provider, access token, and expiry to the local-subscription API route. No affirmative recipient-specific consent gate appears in the transfer path.
Attack narrative
The CLI's worker collects saved access tokens from coding-tool credential stores and sends them to its configured Reason API for local-subscription checks. This is enabled by default. An off switch and disclosure do not provide affirmative consent to send saved third-party tokens to this recipient.
AI rationale
The native CLI has a default active path that transfers saved third-party access tokens to the product API without recipient-specific affirmative consent. The sandbox-runtime similarity and process-execution signals are not the basis for this decision.
Evidence
.lpm-inspection-ZY2sKB/0-1f8a61682da2.txtbin/ara
Network endpoints1
/app/local-runtime/local-subscription at the configured apiOrigin
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The flagged sandbox runtime location filters selected project paths, including agent directories; it does not establish the credential behavior.
- The native CLI defaults an omitted local-login setting to enabled.
- The CLI reads existing credentials from the system keychain and coding-agent credential files; the data includes access tokens.
- When local logins are enabled, worker startup repeatedly submits collected records through the local-subscription API call.
- The client sends those records to `/app/local-runtime/local-subscription` at its configured API origin.
- The CLI describes local-login use and offers an off setting, but access-token submission is enabled by default; the submitted record omits refresh tokens.
Evidence against
- The code submits current access tokens, not refresh tokens, and provides a local-logins off setting.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er...
L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)...
...
L60: mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
5 High3 Medium4 Low
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighKnown Malware Source Similaritybin/runtime/srt/sandbox-runtime.mjs
HighAi Review Evidencebin/runtime/srt/sandbox-runtime.mjs
MediumEnvironment Vars
MediumShips Native Binarybin/Background/Reason.app/Contents/MacOS/ReasonBackgroundIdentity
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @reason-machines/cli-darwin-arm64@0.2.376.
See all versions of @reason-machines/cli-darwin-arm64 for other recorded verdicts.
- Avoid installing @reason-machines/cli-darwin-arm64@0.2.376. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.