@reason-machines/cli-linux-arm64@0.2.323
Reason CLI native binary for linux-arm64
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe worker automatically forwards saved third-party service access tokens to the Reason API when local logins are enabled, which is the default. The CLI describes using local logins and offers an off switch, but does not obtain recipient-specific consent for sending those credentials to Reason.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A Reason worker starts with local logins enabled; the setting defaults on when unspecified.
Impact
Reason receives service access tokens that can authorize access to the user’s provider accounts.
Mechanism
A background loop reads saved provider credentials and submits access tokens to the local-subscription endpoint.
Attack narrative
When a Reason worker starts, it can read saved OAuth credentials from local coding-agent stores. Its background loop sends provider access tokens to Reason’s local-subscription endpoint. The CLI describes local logins as serving Sessions and provides an off switch, but the setting defaults on and the message does not disclose this credential transfer.
AI rationale
The worker automatically forwards saved third-party service access tokens to the Reason API when local logins are enabled, which is the default. The CLI describes using local logins and offers an off switch, but does not obtain recipient-specific consent for sending those credentials to Reason.
Evidence
bin/vm-hands/vm-hands-entry-lite-afthw5ne.jsbin/vm-hands/vm-hands-entry-lite-302p3rc4.jsbin/vm-hands/vm-hands-entry-lite-t497ewn2.jsbin/vm-hands/vm-hands-entry-lite-wh0qp1gf.js~/.claude/.credentials.json~/.codex/auth.json~/.grok/auth.json
Network endpoints2
api.reasonmachines.comstaging-api.reasonmachines.com
Decision evidence
public snapshotAI called this Malicious at 92.0% confidence as Malware with low false-positive risk.
Evidence for block
- The runtime reads saved OAuth credentials from local coding-agent stores, including Claude and Codex authentication files.
- Before submission, it retains each provider’s access token and expiry while dropping the refresh token.
- A background loop passes the saved access token to the local-subscription API.
- The worker starts that loop when local logins are enabled, and the configuration defaults them on when unspecified.
- The request sends its body to the Reason API’s local-subscription endpoint.
- The CLI says local logins serve Sessions and offers an off switch, but does not disclose that the access token is sent to Reason.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
24 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er...
L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)...
...
L60: mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical21 High5 Medium4 Low
CriticalRemote Asset Decode Executebin/vm-hands/index-752q9pdp.js
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighShellbin/vm-hands/vm-hands-entry-lite-afthw5ne.js
HighEvalbin/vm-hands/vm-hands-entry-lite-psybjyay.js
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighObfuscated Payload Loaderbin/vm-hands/index-752q9pdp.js
HighExternal Ai Agent Control Surface Mutationbin/vm-hands/index-752q9pdp.js
HighCross File Remote Execution Contextbin/vm-hands/vm-hands-executor-xtv95azr.js
HighSemantic Analysis Limitedbin/vm-hands/index-752q9pdp.js
Affected versions and remediation
This report applies to @reason-machines/cli-linux-arm64@0.2.323.
See all versions of @reason-machines/cli-linux-arm64 for other recorded verdicts.
- Avoid installing @reason-machines/cli-linux-arm64@0.2.323. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.