registry / Credential exfiltration / @reason-machines/cli-linux-arm64 / 0.2.334

@reason-machines/cli-linux-arm64@0.2.334

Reason CLI native binary for linux-arm64

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Source confirms a default-on runtime path that reads third-party service credentials and sends their access tokens to the publisher's API without an affirmative opt-in. The documented feature and opt-out do not establish recipient-specific consent for that transfer.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A connected session starts while local logins are enabled, which is the default.

Impact

Reason's service receives credentials for other services, creating exposure of those accounts' access tokens to a third-party recipient.

Mechanism

The code reads local provider auth stores, extracts access tokens, and submits them to the local-subscription API. The help documents that Reason receives these tokens, but only provides an opt-out.

Attack narrative

When a connected session starts, the default-on local-login handler reads saved provider credentials and sends each eligible access token to Reason's local-subscription endpoint. The CLI says Reason receives the tokens and provides an off switch, but the transfer does not require an affirmative opt-in. This exposes credentials issued for other services to Reason's API.

AI rationale

Evidence

bin/vm-hands/vm-hands-entry-lite-5peq1sf6.jsbin/vm-hands/vm-hands-entry-lite-mm72ht4e.jsbin/vm-hands/vm-hands-entry-lite-9k57wmkv.jsbin/vm-hands/vm-hands-entry-lite-j4bd5e1q.js~/.claude/.credentials.json~/.codex/auth.json~/.grok/auth.json

Network endpoints1

api.reasonmachines.ai/local-subscription

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Malware with low false-positive risk.

Evidence for block

When a connected session starts with local logins enabled, the handler starts a routine that reads local provider credentials and calls the Reason local-subscription API with each eligible token.
The code extracts Claude OAuth access tokens, reads local Claude, Codex, and Grok auth stores, and retains access tokens for forwarding.
Local logins default to on. The CLI help says Reason receives each login's current access token and offers an off switch, but does not require affirmative opt-in before sending.
The client sends the token through the local-subscription route to the production Reason API by default; a custom API URL is possible, but is not required.

Evidence against

The CLI describes the feature and offers an opt-out, but the setting is enabled by default.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Source & flagged code

23 flagged

bin/runtime/srt/sandbox-runtime.mjsView file

60mux backend dial failed (${H}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(... L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...

High

Child Process

Package source references child process execution.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L60

55\r L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er... L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)... ... L60: mux backend dial failed (${H}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(... L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L55

47\r L48: Connection blocked by network allowlist`);return}if(W||Y.destroyed){Y.destroy();return}let P=jJ(j)??j;if($.mitmCA&&($.shouldTerminateTLS?.(P,C)??!0)){Y.write(`HTTP/1.1 200 Connecti... L49: \r ... L55: \r L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er... L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)... ... L60: mux backend dial failed (${H}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L47

bin/vm-hands/index-g4t2q0ep.jsView file

1// @bun L2: import{P as iJ0}from"./vm-hands-entry-lite-c64behya.js";import{li as NV0,mi as rn,ni as EJ,pi as an,qi as X0}from"./vm-hands-entry-lite-px64jhhn.js";var on={};var $T;var WT=an(()=>... L3: `)!=-1,q=this._styles,O=q.length;while(O--){var E=G[q[O]];if(A=E.open+A.replace(E.closeRe,E.open)+E.close,R)A=A.replace($,function(D){return E.close+D+E.open})}return A}X.setTheme=... L4: `).join(` L5: `+N),U.push(z+"m+"+Y.exports.humanize(this.diff)+"\x1B[0m")}else U[0]=$()+M+" "+U[0]}function $(){if(Q.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}function W(... L6: `)}function K(U){if(U)process.env.DEBUG=U;else delete process.env.DEBUG}function H(){return process.env.DEBUG}function B(U){U.inspectOpts={};let M=Object.keys(Q.inspectOpts);for(le... ... L8: `:` L9: `,U=B.

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

bin/vm-hands/index-g4t2q0ep.jsView on unpkg · L1

271`).map((J)=>J+` L272: `);if(Y)X.pop();else X.push(X.pop().slice(0,-1));return X}function is(Q){let Y=[],X,J;for(let G=0;G<Q.length;G++){if(X=Q[G],X.added)J=1;else if(X.removed)J=-1;else J=0;Y.push([J,X.... L273: `)}var V$=(Q)=>(Y,X,J,G)=>{let Z=J?Object.assign(J,{async:!1}):{async:!1},$=Y._zod.run({value:X,issues:[]},Z);if($ instanceof Promise)throw new AJ;if($.issues.length){let W=new(G?....

High

Eval

Package source references dynamic code evaluation.

bin/vm-hands/index-g4t2q0ep.jsView on unpkg · L271

239`,CHAR_NO_BREAK_SPACE:"\xA0",CHAR_PERCENT:"%",CHAR_PLUS:"+",CHAR_QUESTION_MARK:"?",CHAR_RIGHT_ANGLE_BRACKET:">",CHAR_RIGHT_CURLY_BRACE:"}",CHAR_RIGHT_SQUARE_BRACKET:"]",CHAR_SEMICO... L240: GFS4: `),console.error(A)};if(!X[W]){if(U=global[W]||[],B(X,U),X.close=function(A){function R(q,O){return A.call(X,q,function(E){if(!E)z();if(typeof O==="function")O.apply(this,arg... L241: `:""},this._extScope=S,this._scope=new X.Scope({parent:S}),this._nodes=[new F]}toString(){return this._root.render(this.opts)}name(S){return this._scope.name(S)}scopeName(S){return...

bin/vm-hands/vm-hands-executor-hchyk3n9.jsView file

Lines 1-11javascript

1// @bun

2import{a as Tq}from"./vm-hands-entry-lite-n0g4emqq.js";import{$a as Lq,Fb as Uq,Ha as Bq,Jb as Fq}from"./vm-hands-entry-lite-w9pqckdm.js";import"./vm-hands-entry-lite-h01d2fbm.js";import"./vm-hands-entry-lite-5n6vc7je.js";

bin/araView file

•path = bin/ara kind = native_binary sizeBytes = 102869136 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/araView on unpkg

bin/vm-hands/ask-relay-d37xsgcq.jsView file

•matchType = normalized_sha256 matchedPackage = @reason-machines/cli-linux-arm64@0.2.333 matchedPath = bin/vm-hands/ask-relay-db0gwr3z.js matchedIdentity = npm:[redacted]:0.2.333 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High