@reason-machines/cli-linux-arm64@0.2.330
Reason CLI native binary for linux-arm64
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection shows a default-enabled runtime path that collects existing OAuth credentials for other services and sends them to the Reason API. That unrelated credential transfer supports blocking the package.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The worker starts with local-login handover enabled.
Impact
The Reason service receives credentials intended for other services, exposing those accounts to the recipient.
Mechanism
It reads local provider credentials, including access tokens, and sends them in a request to the Reason local-subscription endpoint.
Attack narrative
The worker reads access tokens from local AI-tool credential stores and submits provider credentials through the Reason client’s local-subscription request. The worker configuration defaults local-login handover to enabled, and its runtime starts the handover when enabled. This sends credentials intended for other services to the Reason API without a recipient-specific consent gate in the inspected path.
AI rationale
Source inspection shows a default-enabled runtime path that collects existing OAuth credentials for other services and sends them to the Reason API. That unrelated credential transfer supports blocking the package.
Evidence
bin/vm-hands/vm-hands-entry-lite-qq1091m3.jsbin/vm-hands/vm-hands-entry-lite-ydjye6jz.jsbin/vm-hands/vm-hands-entry-lite-rnwjp0tk.jsbin/vm-hands/vm-hands-entry-lite-sggk0bqc.js
Network endpoints1
api.reasonmachines.ai/local-subscription
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI reads existing OAuth access tokens from local AI-tool credential stores.
- Its worker submits the collected provider credentials to the Reason service’s local-subscription API.
- The worker enables local-login handover by default and starts it when that option is enabled.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
23 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er...
L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)...
...
L60: mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical21 High5 Medium4 Low
CriticalRemote Asset Decode Executebin/vm-hands/index-wx03jedr.js
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighShell
HighEvalbin/vm-hands/vm-hands-entry-lite-669hk342.js
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighObfuscated Payload Loaderbin/vm-hands/index-wx03jedr.js
HighExternal Ai Agent Control Surface Mutationbin/vm-hands/index-wx03jedr.js
HighCross File Remote Execution Contextbin/vm-hands/vm-hands-executor-rt8r46bt.js
HighSemantic Analysis Limitedbin/vm-hands/index-wx03jedr.js
High
Affected versions and remediation
This report applies to @reason-machines/cli-linux-arm64@0.2.330.
See all versions of @reason-machines/cli-linux-arm64 for other recorded verdicts.
- Avoid installing @reason-machines/cli-linux-arm64@0.2.330. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.