registry / Credential exfiltration / @reason-machines/cli-linux-arm64 / 0.2.349

@reason-machines/cli-linux-arm64@0.2.349

Reason CLI native binary for linux-arm64

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Source shows default-on collection and forwarding of saved third-party access tokens to the publisher's service without a recipient-specific consent gate. This is concrete credential disclosure, so the package should be blocked.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Starting a connected worker with local-login mode enabled, including when the setting is absent and defaults on.

Impact

The Reason service receives access tokens for third-party accounts, exposing those accounts to use through the service.

Mechanism

The worker reads saved provider credentials, selects current access tokens, and submits them in the local-subscription request to the Reason service.

Attack narrative

When a connected worker starts, its default-on local-login feature reads saved credentials for third-party coding services and sends current access tokens to the Reason API. The CLI help discloses this behavior and offers an off switch, but the transfer path does not require recipient-specific affirmative consent before sending saved tokens.

AI rationale

Evidence

bin/vm-hands/vm-hands-entry-lite-svs618mf.jsbin/vm-hands/vm-hands-entry-lite-1xjtcxpn.jsbin/vm-hands/vm-hands-entry-lite-36xzwsxn.js.lpm-inspection-3sISfx/0-316b5fe99f98.txt~/.claude/.credentials.json~/.codex/auth.json~/.grok/auth.json~/.local/share/opencode/auth.json~/.pi/agent/auth.json

Network endpoints1

api.reasonmachines.ai/app/local-runtime/local-subscription

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The local-login helper reads saved Claude credentials and other provider authentication files from the user's home directory.
When local-login mode is enabled, the worker passes collected access tokens to its subscription operation.
If local-login mode is unset, the code defaults it to enabled, and the worker calls the handover helper when that mode is active.
The subscription operation sends its request body to the Reason local-runtime endpoint on the configured production API origin.
The bundled CLI help says local logins are on by default and that Reason receives each login's current access token.

Evidence against

The package manifest has no npm lifecycle hook; the token transfer is activated at runtime when the connected worker starts.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

23 flagged

bin/runtime/srt/sandbox-runtime.mjsView file

60mux backend dial failed (${H}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(... L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...

High

Child Process

Package source references child process execution.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L60

55\r L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er... L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)... ... L60: mux backend dial failed (${H}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(... L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L55

47\r L48: Connection blocked by network allowlist`);return}if(W||Y.destroyed){Y.destroy();return}let P=jJ(j)??j;if($.mitmCA&&($.shouldTerminateTLS?.(P,C)??!0)){Y.write(`HTTP/1.1 200 Connecti... L49: \r ... L55: \r L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er... L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)... ... L60: mux backend dial failed (${H}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L47

bin/vm-hands/index-t1h1wd8g.jsView file

1// @bun L2: import{Q as iJ0}from"./vm-hands-entry-lite-1jhry648.js";import{Ai as X0,vi as NV0,wi as rn,xi as EJ,zi as an}from"./vm-hands-entry-lite-mhsv58hw.js";var on={};var $T;var WT=an(()=>... L3: `)!=-1,q=this._styles,O=q.length;while(O--){var E=G[q[O]];if(A=E.open+A.replace(E.closeRe,E.open)+E.close,R)A=A.replace($,function(D){return E.close+D+E.open})}return A}X.setTheme=... L4: `).join(` L5: `+N),U.push(z+"m+"+Y.exports.humanize(this.diff)+"\x1B[0m")}else U[0]=$()+M+" "+U[0]}function $(){if(Q.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}function W(... L6: `)}function K(U){if(U)process.env.DEBUG=U;else delete process.env.DEBUG}function H(){return process.env.DEBUG}function B(U){U.inspectOpts={};let M=Object.keys(Q.inspectOpts);for(le... ... L8: `:` L9: `,U=B.

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

bin/vm-hands/index-t1h1wd8g.jsView on unpkg · L1

271`).map((J)=>J+` L272: `);if(Y)X.pop();else X.push(X.pop().slice(0,-1));return X}function is(Q){let Y=[],X,J;for(let G=0;G<Q.length;G++){if(X=Q[G],X.added)J=1;else if(X.removed)J=-1;else J=0;Y.push([J,X.... L273: `)}var V$=(Q)=>(Y,X,J,G)=>{let Z=J?Object.assign(J,{async:!1}):{async:!1},$=Y._zod.run({value:X,issues:[]},Z);if($ instanceof Promise)throw new AJ;if($.issues.length){let W=new(G?....

High

Eval

Package source references dynamic code evaluation.

bin/vm-hands/index-t1h1wd8g.jsView on unpkg · L271

239`,CHAR_NO_BREAK_SPACE:"\xA0",CHAR_PERCENT:"%",CHAR_PLUS:"+",CHAR_QUESTION_MARK:"?",CHAR_RIGHT_ANGLE_BRACKET:">",CHAR_RIGHT_CURLY_BRACE:"}",CHAR_RIGHT_SQUARE_BRACKET:"]",CHAR_SEMICO... L240: GFS4: `),console.error(A)};if(!X[W]){if(U=global[W]||[],B(X,U),X.close=function(A){function R(q,O){return A.call(X,q,function(E){if(!E)z();if(typeof O==="function")O.apply(this,arg... L241: `:""},this._extScope=S,this._scope=new X.Scope({parent:S}),this._nodes=[new F]}toString(){return this._root.render(this.opts)}name(S){return this._scope.name(S)}scopeName(S){return...

bin/vm-hands/vm-hands-entry-lite-f66d7y5a.jsView file

Lines 285-325javascript

285 // parse top-level await or return. Those programs retain the prior async

286 // block behavior; a syntax failure occurs before any user code executes.

287 if (!statementList || !(error instanceof SyntaxError)) throw error;

288 program =

bin/vm-hands/vm-hands-executor-6q1n7hpe.jsView file

Lines 1-11javascript

1// @bun

2import{a as Mq}from"./vm-hands-entry-lite-q756n4nh.js";import{Gb as Fq,Ia as Lq,Kb as Tq,ab as Uq}from"./vm-hands-entry-lite-f66d7y5a.js";import"./vm-hands-entry-lite-wmxksawm.js";import

bin/araView file

•path = bin/ara kind = native_binary sizeBytes = 102869136 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/araView on unpkg

bin/vm-hands/ask-relay-qr4gmz44.jsView file

•matchType = normalized_sha256 matchedPackage = @reason-machines/cli-linux-arm64@0.2.347 matchedPath = bin/vm-hands/ask-relay-r3kbaq9w.js matchedIdentity = npm:[redacted]:0.2.347 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High