registry / @reason-machines/cli-linux-arm64-musl / 0.2.414
@reason-machines/cli-linux-arm64-musl@0.2.414
⚠ Under reviewReason CLI native binary for linux-arm64-musl
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged project configuration behavior is an explicit skill-install command, and the manifest has no lifecycle hooks. The large native executable and an unrecognized bundled executable remain materially unresolved, so the source evidence does not support a clean or malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Use of a bundled native executable could activate behavior that the inspected source windows do not resolve.
Impact
The native executables' effects cannot be determined, so an attack cannot be confirmed or excluded.
Mechanism
The analysis provides bounded embedded-source candidates but cannot establish their reachability or rule out other native behavior; another executable is unrecognized by the available analysis.
AI rationale
The flagged project configuration behavior is an explicit skill-install command, and the manifest has no lifecycle hooks. The large native executable and an unrecognized bundled executable remain materially unresolved, so the source evidence does not support a clean or malicious verdict.
Evidence
bin/reason.lpm-inspection-MGkJaw/0-4b41bfc965f2.txtbin/runtime/srt/vendor/seccomp/arm64/apply-seccomp.lpm-inspection-MGkJaw/1-9ace43a76dab.txt
Decision evidence
public snapshotAI called this Manual Review at 86.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest describes a Linux ARM64 musl CLI package and declares no lifecycle hooks.
- The sandbox runtime lists `.claude/commands` and `.claude/agents` in its path handling code.
- The bundled Playwright trace installer copies a package-provided skill into the current project when its command runs.
- The native executable is an 83 MB ELF; its bounded source analysis does not establish loader reachability or rule out other behavior.
- A second bundled executable has no supported behavior analysis.
Evidence against
- The `.claude/skills` write is behind an explicit `install-skill` command, not a package lifecycle hook.
- The inspected JavaScript and artifact analyses do not confirm an attack or data transfer.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
12 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{a.add(l),l.once("close",()=>a.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(a)=>{C(`Client request error: ${a.message}`,{level:"error"})}),i.on("error",(a)=>{C(`Client response error: ${a.message}`,{level:"er...
L57: `)),e.end(cx(s))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(s)=>{e.off("data",a),clearTimeout(i),t(s)...
...
L60: mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{a.add(l),l.once("close",()=>a.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical10 High5 Medium4 Low
CriticalRemote Asset Decode Executebin/vm-hands/index-k8kcz8a3.js
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighShell
HighEvalbin/vm-hands/index-k8kcz8a3.js
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighObfuscated Payload Loaderbin/vm-hands/index-k8kcz8a3.js
HighExternal Ai Agent Control Surface Mutationbin/vm-hands/index-k8kcz8a3.js
HighCross File Remote Execution Contextbin/vm-hands/index-k8kcz8a3.js
HighSemantic Analysis Limitedbin/vm-hands/index-k8kcz8a3.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @reason-machines/cli-linux-arm64-musl@0.2.414.
See all versions of @reason-machines/cli-linux-arm64-musl for other recorded verdicts.
- Review the evidence and your use of @reason-machines/cli-linux-arm64-musl@0.2.414 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.