registry / Credential exfiltration / @reason-machines/cli-linux-arm64

@reason-machines/cli-linux-arm64

Reason CLI native binary for linux-arm64

This report shows the evidence for @reason-machines/cli-linux-arm64@0.2.506. 30 of 283 known versions are blocked or flagged. The newest version, 0.2.547, is allowed. See all versions.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The inspected embedded source confirms an automatic transfer of saved third-party access tokens to the package’s Reason API, enabled by default without recipient-specific affirmative consent. This is concrete credential disclosure, so the package should be blocked.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Starting the worker with the default local-login setting.

Impact

Third-party account access tokens are disclosed to Reason’s backend without recipient-specific affirmative consent.

Mechanism

The runtime reads saved provider credentials, keeps access tokens, and submits them through the device-authenticated local-subscription request.

Attack narrative

When the worker starts, its default configuration enables local-login handoff unless an API key is supplied. The runtime reads saved provider credentials and sends access tokens to the configured Reason API’s local-subscription route. The CLI discloses the behavior and provides an opt-out, but neither makes the transfer recipient-selected or affirmatively consented.

AI rationale

Evidence

.lpm-inspection-HKGqG6/0-3ac31fdbdac8.txt

Network endpoints1

/app/local-runtime/local-subscription

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The embedded runtime reads provider credentials from local stores and files.
It sends provider access tokens and expiry values through the local-subscription request.
Worker startup automatically starts this handoff when local logins are enabled.
Configuration defaults local logins to on when no API key is supplied.
The request goes to the worker’s configured API origin and the local-subscription route.
The CLI describes Reason receiving current third-party access tokens; the transfer is on by default.

Evidence against

The CLI describes the transfer and offers an off switch, but disclosure and an opt-out do not provide affirmative consent to send credentials to Reason.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

24 flagged

bin/runtime/srt/sandbox-runtime.mjsView file

60mux backend dial failed (${d}) L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=px((l)=>{a.add(l),l.once("close",()=>a.delete(l)),l.on(... L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as dr,dirname as Vx}from"path";import{fileURLToPath as Fx}from"url";import*...

High

Child Process

Package source references child process execution.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L60

55\r L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(a)=>{C(`Client request error: ${a.message}`,{level:"error"})}),i.on("error",(a)=>{C(`Client response error: ${a.message}`,{level:"er... L57: `)),e.end(fx(s))}function _l(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function dx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(s)=>{e.off("data",a),clearTimeout(i),t(s)... ... L60: mux backend dial failed (${d}) L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=px((l)=>{a.add(l),l.once("close",()=>a.delete(l)),l.on(... L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as dr,dirname as Vx}from"path";import{fileURLToPath as Fx}from"url";import*

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L55

47\r L48: Connection blocked by network allowlist`);return}if(s||i.destroyed){i.destroy();return}let R=_t(E)??E;if(e.mitmCA&&(e.shouldTerminateTLS?.(R,k)??!0)){i.write(`HTTP/1.1 200 Connecti... L49: \r ... L55: \r L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(a)=>{C(`Client request error: ${a.message}`,{level:"error"})}),i.on("error",(a)=>{C(`Client response error: ${a.message}`,{level:"er... L57: `)),e.end(fx(s))}function _l(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function dx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(s)=>{e.off("data",a),clearTimeout(i),t(s)... ... L60: mux backend dial failed (${d}) L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=px((l)=>{a.add(l),l.once("close",()

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L47

bin/vm-hands/vm-hands-entry-lite-gvjffc5t.jsView file

Lines 1-21javascript

1// @bun

2import{us}from"./vm-hands-entry-lite-mk5ayds8.js";var Xr,Uo=Object.freeze({status:"aborted"});function z(e,r,a){function

bin/vm-hands/vm-hands-entry-lite-6x1an7es.jsView file

Lines 1-8javascript

1// @bun

2import{Nt}from"./vm-hands-entry-lite-np07qyeq.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{fe,se,C}from"./vm-hands-entry-lite-87vmbt38.js";import{spawn as J,spawnSync as ee}from"child_process";

bin/vm-hands/vm-hands-entry-lite-xwqrndky.jsView file

Lines 1-21javascript

1// @bun

2import{T}from"./vm-hands-entry-lite-fcvf8md1.js";import{_}from"./vm-hands-entry-lite-nqdstx24.js";import{Kr,ei,Jr,ti}from"./vm-hands-entry-lite-hmaazqdr.js";import{Xn,Yt,Io}from"./vm-hands-entry-lite-nkp4ccvt.js";import{C}from

bin/vm-hands/index-ttmxy9nd.jsView file

1// @bun L2: import{un}from"./vm-hands-entry-lite-ewr54tpc.js";import{Li,he,e}from"./vm-hands-entry-lite-mk5ayds8.js";var Ce=he(function(C6,ly){var __dirname="/[redacted]... L3: `)!=-1,y=this._styles,E=y.length;while(E--){var S=s[y[E]];if(g=S.open+g.replace(S.closeRe,S.open)+S.close,b)g=g.replace(a,function(x){return S.close+x+S.open})}return g}n.setTheme=... L4: `).join(` L5: `+_),p.push(w+"m+"+r.exports.humanize(this.diff)+"\x1B[0m")}else p[0]=a()+f+" "+p[0]}function a(){if(t.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}function l(... L6: `)}function c(p){if(p)process.env.DEBUG=p;else delete process.env.DEBUG}function u(){return process.env.DEBUG}function d(p){p.inspectOpts={};let f=Object.keys(t.inspectOpts);for(le... ... L8: `:` L9: `,p=d.whitespace?" = ":"=",f=

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

bin/vm-hands/index-ttmxy9nd.jsView on unpkg · L1

239`,CHAR_NO_BREAK_SPACE:"\xA0",CHAR_PERCENT:"%",CHAR_PLUS:"+",CHAR_QUESTION_MARK:"?",CHAR_RIGHT_ANGLE_BRACKET:">",CHAR_RIGHT_CURLY_BRACE:"}",CHAR_RIGHT_SQUARE_BRACKET:"]",CHAR_SEMICO... L240: GFS4: `),console.error(g)};if(!n[l]){if(p=global[l]||[],d(n,p),n.close=function(g){function b(y,E){return g.call(n,y,function(S){if(!S)w();if(typeof E==="function")E.apply(this,arg... L241: `:""},this._extScope=D,this._scope=new n.Scope({parent:D}),this._nodes=[new v]}toString(){return this._root.render(this.opts)}name(D){return this._scope.name(D)}scopeName(D){return...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

bin/vm-hands/index-ttmxy9nd.jsView on unpkg · L239

bin/runtime/srt/vendor/seccomp/arm64/apply-seccompView file

•path = [redacted]-seccomp kind = native_binary sizeBytes = 603200 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/runtime/srt/vendor/seccomp/arm64/apply-seccompView on unpkg

bin/vm-hands/vm-hands-entry-lite-77j164ps.jsView file

•matchType = normalized_sha256 matchedPackage = @reason-machines/cli-linux-x64@0.2.494 matchedPath = bin/vm-hands/vm-hands-entry-lite-nnzqx15h.js matchedIdentity = npm:[redacted]:0.2.494 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High