@reason-machines/cli-darwin-x64@0.2.362: Manual Review npm

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The manifest has no install lifecycle scripts, and the inspected agent-config location is used as an ignore path in a sandbox search helper. The native CLI remains materially unresolved because its analysis covers only bounded embedded-source windows, so the source does not support a clean or malicious verdict.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Running the packaged CLI executable.

Impact

Unknown; no specific malicious effect was confirmed.

Mechanism

The executable is a native Bun binary, but the available offline analysis does not establish which embedded source is reachable or cover all native behavior.

AI rationale

The manifest has no install lifecycle scripts, and the inspected agent-config location is used as an ignore path in a sandbox search helper. The native CLI remains materially unresolved because its analysis covers only bounded embedded-source windows, so the source does not support a clean or malicious verdict.

Evidence

.lpm-inspection-gsjt7L/0-6562473f1376.txt

Decision evidence

public snapshot

AI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json identifies a macOS x64 CLI and contains no lifecycle scripts.
The runtime source lists .mcp.json among ignored paths; its search helper passes those paths as ignore globs, with no agent configuration write established at the inspected location.
The offline analysis identifies bin/ara as a 78 MB Mach-O Bun executable with bounded embedded source candidates.
The analysis warns that these bounded windows cannot establish executable reachability or rule out other native behavior.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 1 file(s), 524 KB of source, external domains: 127.0.0.1

Source & flagged code

6 flagged

bin/runtime/srt/sandbox-runtime.mjsView file

60mux backend dial failed (${H}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(... L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...

High

Child Process

Package source references child process execution.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L60

55\r L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er... L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)... ... L60: mux backend dial failed (${H}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(... L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L55

47\r L48: Connection blocked by network allowlist`);return}if(W||Y.destroyed){Y.destroy();return}let P=jJ(j)??j;if($.mitmCA&&($.shouldTerminateTLS?.(P,C)??!0)){Y.write(`HTTP/1.1 200 Connecti... L49: \r ... L55: \r L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er... L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)... ... L60: mux backend dial failed (${H}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L47

•matchType = normalized_sha256 matchedPackage = @reason-machines/cli-linux-arm64-musl@0.2.360 matchedPath = bin/runtime/srt/sandbox-runtime.mjs matchedIdentity = npm:[redacted]:0.2.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = cffabf61dada78bc signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @reason-machines/cli-darwin-arm64@0.2.341 matchedPath = bin/runtime/srt/sandbox-runtime.mjs matchedIdentity = npm:[redacted]:0.2.341 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg

bin/Background/Reason.app/Contents/MacOS/ReasonBackgroundIdentityView file

•path = bin/Background/Reason.[redacted] kind = native_binary sizeBytes = 34864 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/Background/Reason.app/Contents/MacOS/ReasonBackgroundIdentityView on unpkg

Source & flagged code

6 flagged · loading source

bin/runtime/srt/sandbox-runtime.mjsView file

60mux backend dial failed (${H}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(... L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...

High

Child Process

Package source references child process execution.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L60

55\r L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er... L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)... ... L60: mux backend dial failed (${H}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(... L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Findings

5 High3 Medium4 Low

HighChild Processbin/runtime/srt/sandbox-runtime.mjs

HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs

HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs

HighKnown Malware Source Similaritybin/runtime/srt/sandbox-runtime.mjs

HighKnown Malware Source Fingerprint Signaturebin/runtime/srt/sandbox-runtime.mjs

MediumEnvironment Vars

MediumShips Native Binarybin/Background/Reason.app/Contents/MacOS/ReasonBackgroundIdentity

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @reason-machines

Behavioral surface

Related packages

More from @reason-machines

Source & flagged code