@reason-machines/cli-darwin-x64@0.2.449: Manual Review npm

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The manifest and flagged runtime excerpt do not establish malicious behavior, but the package's primary native executable has only bounded embedded-source analysis, including authentication-store reads without resolved callers or sinks. This material gap prevents a source-grounded clean verdict; no concrete attack was verified.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Running the packaged CLI would activate the native executable; its relevant code paths could not be established from the available analysis.

Impact

Unknown; the inspected evidence does not confirm credential transfer or another attack effect.

Mechanism

The analysis exposes some embedded CLI source, including authentication-store reads, but does not establish reachability, data flow, or any recipient.

AI rationale

The manifest and flagged runtime excerpt do not establish malicious behavior, but the package's primary native executable has only bounded embedded-source analysis, including authentication-store reads without resolved callers or sinks. This material gap prevents a source-grounded clean verdict; no concrete attack was verified.

Evidence

bin/reason.lpm-inspection-CphFJF/0-3b2881dea1ef.txt

Decision evidence

public snapshot

AI called this Manual Review at 86.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest identifies this as the Darwin x64 Reason CLI and declares no lifecycle hook.
The flagged runtime excerpt includes project paths such as Claude commands and agents in a path list; that excerpt alone does not establish configuration mutation.
The native executable is a 78 MB Mach-O containing bounded embedded source candidates, and the offline analysis says those candidates cannot establish loader reachability or rule out other native behavior.
A bounded embedded-source excerpt reads several CLI authentication stores, but the inspected evidence does not establish how those values are used or sent.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 1 file(s), 524 KB of source, external domains: 127.0.0.1

Source & flagged code

6 flagged

bin/runtime/srt/sandbox-runtime.mjsView file

60mux backend dial failed (${d}) L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(... L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*...

High

Child Process

Package source references child process execution.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L60

55\r L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(s)=>{C(`Client request error: ${s.message}`,{level:"error"})}),i.on("error",(s)=>{C(`Client response error: ${s.message}`,{level:"er... L57: `)),e.end(cx(a))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(a)=>{e.off("data",s),clearTimeout(i),t(a)... ... L60: mux backend dial failed (${d}) L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(... L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L55

47\r L48: Connection blocked by network allowlist`);return}if(a||i.destroyed){i.destroy();return}let R=_t(E)??E;if(e.mitmCA&&(e.shouldTerminateTLS?.(R,k)??!0)){i.write(`HTTP/1.1 200 Connecti... L49: \r ... L55: \r L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(s)=>{C(`Client request error: ${s.message}`,{level:"error"})}),i.on("error",(s)=>{C(`Client response error: ${s.message}`,{level:"er... L57: `)),e.end(cx(a))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(a)=>{e.off("data",s),clearTimeout(i),t(a)... ... L60: mux backend dial failed (${d}) L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L47

•matchType = normalized_sha256 matchedPackage = @reason-machines/cli-darwin-arm64@0.2.434 matchedPath = bin/runtime/srt/sandbox-runtime.mjs matchedIdentity = npm:[redacted]:0.2.434 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 129ef91bac8b46ac signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @reason-machines/cli-darwin-arm64@0.2.434 matchedPath = bin/runtime/srt/sandbox-runtime.mjs matchedIdentity = npm:[redacted]:0.2.434 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg

bin/Background/Reason.app/Contents/MacOS/ReasonBackgroundIdentityView file

•path = bin/Background/Reason.[redacted] kind = native_binary sizeBytes = 34896 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/Background/Reason.app/Contents/MacOS/ReasonBackgroundIdentityView on unpkg

Source & flagged code

6 flagged · loading source

bin/runtime/srt/sandbox-runtime.mjsView file

60mux backend dial failed (${d}) L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(... L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*...

High

Child Process

Package source references child process execution.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L60

55\r L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(s)=>{C(`Client request error: ${s.message}`,{level:"error"})}),i.on("error",(s)=>{C(`Client response error: ${s.message}`,{level:"er... L57: `)),e.end(cx(a))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(a)=>{e.off("data",s),clearTimeout(i),t(a)... ... L60: mux backend dial failed (${d}) L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(... L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Findings

5 High3 Medium4 Low

HighChild Processbin/runtime/srt/sandbox-runtime.mjs

HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs

HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs

HighKnown Malware Source Similaritybin/runtime/srt/sandbox-runtime.mjs

HighKnown Malware Source Fingerprint Signaturebin/runtime/srt/sandbox-runtime.mjs

MediumEnvironment Vars

MediumShips Native Binarybin/Background/Reason.app/Contents/MacOS/ReasonBackgroundIdentity

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @reason-machines

Behavioral surface

Related packages

More from @reason-machines

Source & flagged code