@reason-machines/cli-darwin-x64@0.2.380
Reason CLI native binary for darwin-x64
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe source shows default-on forwarding of saved third-party access tokens to Reason without an affirmative opt-in gate, so warn about conditional credential exposure. The behavior is disclosed and package-aligned, and no install-hook attack is established.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A Reason worker starts with local logins enabled and finds usable saved provider credentials.
Impact
Third-party provider access tokens are disclosed to Reason’s service during this feature’s operation. The source documents this behavior but does not enforce an affirmative opt-in by default.
Mechanism
The worker reads credentials from local agent files and keychain sources, then sends provider access tokens to the `/local-subscription` route.
AI rationale
The source shows default-on forwarding of saved third-party access tokens to Reason without an affirmative opt-in gate, so warn about conditional credential exposure. The behavior is disclosed and package-aligned, and no install-hook attack is established.
Evidence
.lpm-inspection-KveZNY/0-19b51e9c0166.txt
Decision evidence
public snapshotAI called this Suspicious at 80.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest identifies a platform-specific CLI package and declares no lifecycle script; the verified token transfer occurs at runtime.
- The native source defaults local logins on when unset and calls the transfer helper when the worker starts with that setting enabled.
- The helper reads credentials from local AI tool and keychain sources, then retains provider access tokens for the request.
- The worker passes collected credentials to its local-subscription client, which sends a request to the `/local-subscription` route.
- The CLI help discloses that local logins are on by default and that Reason receives current access tokens, not refresh tokens.
- The `.mcp.json` match is part of sandbox write protections; it does not show agent configuration mutation.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
6 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er...
L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)...
...
L60: mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
4 High4 Medium4 Low
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighKnown Malware Source Similaritybin/runtime/srt/sandbox-runtime.mjs
MediumEnvironment Vars
MediumShips Native Binarybin/Background/Reason.app/Contents/MacOS/ReasonBackgroundIdentity
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @reason-machines/cli-darwin-x64@0.2.380.
See all versions of @reason-machines/cli-darwin-x64 for other recorded verdicts.
- Review the evidence and your use of @reason-machines/cli-darwin-x64@0.2.380 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.