registry / @reason-machines/cli-darwin-x64 / 0.2.373
@reason-machines/cli-darwin-x64@0.2.373
⚠ Under reviewReason CLI native binary for darwin-x64
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe inspected code shows credential collection and a transfer path, but the bounded native analysis does not establish the effective recipient or consent, and does not resolve the full executable. Manual review is needed to determine whether this is the intended session feature or an unsafe disclosure.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Starting the worker with local login support enabled; the inspected configuration defaults that setting on when unspecified.
Impact
Local coding agent credentials may be disclosed to the configured service; the effective recipient and consent are unresolved.
Mechanism
The worker reads credentials from local coding agent stores and submits them through a device-authenticated subscription call.
AI rationale
The inspected code shows credential collection and a transfer path, but the bounded native analysis does not establish the effective recipient or consent, and does not resolve the full executable. Manual review is needed to determine whether this is the intended session feature or an unsafe disclosure.
Evidence
bin/ara.lpm-inspection-9wGi4Q/0-f556c16b8deb.txtbin/runtime/srt/sandbox-runtime.mjs
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest identifies a Darwin x64 CLI package and has no lifecycle scripts.
- The inspected runtime includes .mcp.json and agent command and agent paths in a path list; the cited excerpt shows no configuration write.
- The native executable analysis contains only bounded embedded source windows and says they cannot establish its full behavior.
Evidence against
- When local login support is unset, the inspected native source enables it by default and starts a handoff when enabled.
- The handoff reads credentials from local coding agent stores and repeatedly submits them through a local subscription call.
- The source identifies a device-authenticated /local-subscription route, but the effective API origin, recipient consent, and the rest of the native executable remain unresolved.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
HighEntropyStringsMinified
Source & flagged code
6 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er...
L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)...
...
L60: mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
5 High3 Medium4 Low
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighKnown Malware Source Similaritybin/runtime/srt/sandbox-runtime.mjs
HighKnown Malware Source Fingerprint Signaturebin/runtime/srt/sandbox-runtime.mjs
MediumEnvironment Vars
MediumShips Native Binarybin/Background/Reason.app/Contents/MacOS/ReasonBackgroundIdentity
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @reason-machines/cli-darwin-x64@0.2.373.
See all versions of @reason-machines/cli-darwin-x64 for other recorded verdicts.
- Review the evidence and your use of @reason-machines/cli-darwin-x64@0.2.373 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.