registry / @reason-machines/cli-linux-arm64-musl / 0.2.384
@reason-machines/cli-linux-arm64-musl@0.2.384
⚠ Under reviewReason CLI native binary for linux-arm64-musl
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe inspected JavaScript shows a gated, Reason-aligned local-login feature and does not establish a concrete attack. The large native executable remains materially unresolved, so the package needs manual review before a clean or malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The unresolved behavior may activate when the packaged CLI runs; the native executable's activation paths could not be established from the available analysis.
Impact
Unknown until the native executable's behavior is sufficiently analyzed.
Mechanism
The native analysis exposes bounded embedded-source candidates but does not establish their reachability or account for other native behavior.
AI rationale
The inspected JavaScript shows a gated, Reason-aligned local-login feature and does not establish a concrete attack. The large native executable remains materially unresolved, so the package needs manual review before a clean or malicious verdict.
Evidence
bin/ara.lpm-inspection-bMvAc3/0-e360793c480a.txt
Decision evidence
public snapshotAI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest ships a bin directory; the inspected analysis identifies bin/ara as a large ELF Bun executable.
- The runtime reads saved local provider credentials and can send eligible access tokens through the local-subscription API when localLogins is enabled.
- Connection setup defaults localLogins on and explains its use to users; it also validates API origins against the selected Reason channel.
- Inspected agent-related excerpts show a project-local Playwright skill copy and Cursor configuration parsing, but do not establish their call reachability.
- The native executable analysis is limited to embedded-source windows and says it cannot establish bytecode reachability or rule out other native behavior.
Evidence against
- The inspected JavaScript gates local credential forwarding on localLogins and routes it to Reason's local-subscription endpoint; the configured API origin is checked against the selected Reason channel.
- The inspected excerpts do not establish an unconsented transfer to a foreign recipient or another confirmed attack.
Behavioral surface
Source & flagged code
25 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er...
L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)...
...
L60: mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical21 High6 Medium4 Low
CriticalRemote Asset Decode Executebin/vm-hands/index-7f2kwwen.js
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighShellbin/vm-hands/vm-hands-entry-lite-bfk9ndx8.js
HighEvalbin/vm-hands/vm-hands-entry-lite-zjfr0zh8.js
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighObfuscated Payload Loaderbin/vm-hands/index-7f2kwwen.js
HighExternal Ai Agent Control Surface Mutationbin/vm-hands/index-7f2kwwen.js
HighCross File Remote Execution Contextbin/vm-hands/vm-hands-entry-lite-qvdvh2v9.js
HighSemantic Analysis Limitedbin/vm-hands/index-7f2kwwen.js
Affected versions and remediation
This report applies to @reason-machines/cli-linux-arm64-musl@0.2.384.
See all versions of @reason-machines/cli-linux-arm64-musl for other recorded verdicts.
- Review the evidence and your use of @reason-machines/cli-linux-arm64-musl@0.2.384 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.