@reason-machines/cli-linux-arm64@0.2.362
Reason CLI native binary for linux-arm64
AI Security Review
scanned 6d ago · by lpm-firewall-aiInspected runtime source confirms a default-enabled transfer of saved third-party access tokens to the package’s configured Reason API. This is concrete credential exfiltration and supports blocking publication.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The worker starts with local logins enabled; connection setup defaults that setting on when it is omitted.
Impact
The service receives credentials for third-party accounts, exposing those accounts to access through the service.
Mechanism
It reads saved agent credentials, keeps provider and access-token fields, and submits them as the request body without recipient-specific consent.
Attack narrative
The worker gathers saved credentials for third-party coding-agent accounts and sends their access tokens to the Reason API through the local-subscription route. This transfer runs when local logins are enabled, and connection setup enables them by default when the setting is absent. The source does not establish recipient-specific consent for sending those credentials to the service.
AI rationale
Inspected runtime source confirms a default-enabled transfer of saved third-party access tokens to the package’s configured Reason API. This is concrete credential exfiltration and supports blocking publication.
Evidence
bin/vm-hands/vm-hands-entry-lite-p7vdv1f0.jsbin/vm-hands/vm-hands-entry-lite-qbfdh50w.jsbin/vm-hands/vm-hands-entry-lite-p1nb6n3r.js.lpm-inspection-GIOBQq/0-1d03417c6bbc.txt
Network endpoints1
api.reasonmachines.ai
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The runtime reads saved coding-agent credentials and retains provider, access token, and expiry fields.
- A worker repeatedly submits collected credentials through its local-subscription client call.
- The worker starts when local logins are enabled; that setting defaults on when omitted during connection setup.
- The client sends the credential object to the local-subscription route, and the configured production API host is api.reasonmachines.ai.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
23 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er...
L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)...
...
L60: mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical21 High5 Medium4 Low
CriticalRemote Asset Decode Executebin/vm-hands/index-80ep9259.js
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighShell
HighEvalbin/vm-hands/index-80ep9259.js
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighObfuscated Payload Loaderbin/vm-hands/index-80ep9259.js
HighExternal Ai Agent Control Surface Mutationbin/vm-hands/index-80ep9259.js
HighCross File Remote Execution Contextbin/vm-hands/vm-hands-executor-tpjvmah3.js
HighSemantic Analysis Limitedbin/vm-hands/index-80ep9259.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @reason-machines/cli-linux-arm64@0.2.362.
See all versions of @reason-machines/cli-linux-arm64 for other recorded verdicts.
- Avoid installing @reason-machines/cli-linux-arm64@0.2.362. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.