registry / Credential exfiltration / @reason-machines/cli-linux-x64-musl / 0.2.398

@reason-machines/cli-linux-x64-musl@0.2.398

Reason CLI native binary for linux-x64-musl

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The inspected runtime establishes an automatic transfer of saved third-party credentials to the package’s API host without recipient-specific consent. This is concrete credential exfiltration behavior and supports blocking publication.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Connecting the CLI starts its worker with local logins enabled by default.

Impact

The Reason service receives reusable credentials for the user’s third-party accounts.

Mechanism

The worker reads local authentication stores, extracts access tokens, and submits them to the local-subscription endpoint on the configured API host.

Attack narrative

When the CLI worker starts, it can read saved credentials for Claude, Codex, Grok, and OpenCode. With local logins enabled by default, it repeatedly sends collected access tokens through the local-subscription API to the Reason service. The source does not show recipient-specific consent for exporting these third-party credentials.

AI rationale

Evidence

bin/vm-hands/vm-hands-entry-lite-qv9j0tb5.jsbin/vm-hands/vm-hands-entry-lite-xdfghcd0.jsbin/vm-hands/vm-hands-entry-lite-09yt840b.jsbin/vm-hands/vm-hands-entry-lite-923jmcs3.js

Network endpoints1

api.reasonmachines.ai

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The runtime reads saved Claude, Codex, Grok, and OpenCode authentication data; it extracts reusable access and refresh tokens.
The worker sends collected credentials through its local-subscription request and repeats the transfer when credentials change or need refreshing.
Starting the worker enables this transfer when local logins are enabled, and the connect configuration defaults that option to enabled.
The request uses the local-subscription API route and defaults to the package’s production Reason API host.
The source does not establish recipient-specific consent before saved third-party credentials are sent to that host.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

23 flagged

bin/runtime/srt/sandbox-runtime.mjsView file

60mux backend dial failed (${q}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=UH((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(... L62: `).filter(Boolean);if(N===1)return[];throw Error(`ripgrep failed with exit code ${N}: ${H}`)}import{join as V0,dirname as xH}from"path";import{fileURLToPath as vH}from"url";import*...

High

Child Process

Package source references child process execution.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L60

55\r L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er... L57: `)),$.end(WH(W))}function D7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function GH($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)... ... L60: mux backend dial failed (${q}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=UH((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(... L62: `).filter(Boolean);if(N===1)return[];throw Error(`ripgrep failed with exit code ${N}: ${H}`)}import{join as V0,dirname as xH}from"path";import{fileURLToPath as vH}from"url";import*

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L55

47\r L48: Connection blocked by network allowlist`);return}if(W||Y.destroyed){Y.destroy();return}let P=jJ(B)??B;if($.mitmCA&&($.shouldTerminateTLS?.(P,C)??!0)){Y.write(`HTTP/1.1 200 Connecti... L49: \r ... L55: \r L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er... L57: `)),$.end(WH(W))}function D7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function GH($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)... ... L60: mux backend dial failed (${q}) L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=UH((M)=>{G.add(M),M.once("close",()

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L47

bin/vm-hands/index-58750fwy.jsView file

1// @bun L2: import{Aa as iJ0}from"./vm-hands-entry-lite-z9y1sb0f.js";import{Nk as NV0,Ok as rn,Pk as EJ,Rk as an,Sk as X0}from"./vm-hands-entry-lite-4yw8vx5h.js";var on={};var $T;var WT=an(()=... L3: `)!=-1,q=this._styles,O=q.length;while(O--){var E=G[q[O]];if(A=E.open+A.replace(E.closeRe,E.open)+E.close,R)A=A.replace($,function(D){return E.close+D+E.open})}return A}X.setTheme=... L4: `).join(` L5: `+N),U.push(z+"m+"+Y.exports.humanize(this.diff)+"\x1B[0m")}else U[0]=$()+M+" "+U[0]}function $(){if(Q.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}function W(... L6: `)}function K(U){if(U)process.env.DEBUG=U;else delete process.env.DEBUG}function H(){return process.env.DEBUG}function B(U){U.inspectOpts={};let M=Object.keys(Q.inspectOpts);for(le... ... L8: `:` L9: `,U=B.

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

bin/vm-hands/index-58750fwy.jsView on unpkg · L1

271`).map((J)=>J+` L272: `);if(Y)X.pop();else X.push(X.pop().slice(0,-1));return X}function is(Q){let Y=[],X,J;for(let G=0;G<Q.length;G++){if(X=Q[G],X.added)J=1;else if(X.removed)J=-1;else J=0;Y.push([J,X.... L273: `)}var V$=(Q)=>(Y,X,J,G)=>{let Z=J?Object.assign(J,{async:!1}):{async:!1},$=Y._zod.run({value:X,issues:[]},Z);if($ instanceof Promise)throw new AJ;if($.issues.length){let W=new(G?....

High

Eval

Package source references dynamic code evaluation.

bin/vm-hands/index-58750fwy.jsView on unpkg · L271

239`,CHAR_NO_BREAK_SPACE:"\xA0",CHAR_PERCENT:"%",CHAR_PLUS:"+",CHAR_QUESTION_MARK:"?",CHAR_RIGHT_ANGLE_BRACKET:">",CHAR_RIGHT_CURLY_BRACE:"}",CHAR_RIGHT_SQUARE_BRACKET:"]",CHAR_SEMICO... L240: GFS4: `),console.error(A)};if(!X[W]){if(U=global[W]||[],B(X,U),X.close=function(A){function R(q,O){return A.call(X,q,function(E){if(!E)z();if(typeof O==="function")O.apply(this,arg... L241: `:""},this._extScope=S,this._scope=new X.Scope({parent:S}),this._nodes=[new F]}toString(){return this._root.render(this.opts)}name(S){return this._scope.name(S)}scopeName(S){return...

bin/vm-hands/vm-hands-executor-652ckfnw.jsView file

Lines 1-12javascript

1// @bun

2import{s as wq}from"./vm-hands-entry-lite-vz6nt5sc.js";import{Mb as Nq,qc as Aq,wb as jq,wc as Rq}from"./vm-hands-entry-lite-jkcbweew.js";import"./vm-hands-entry-lite-fkkmhfjc.js";import

bin/runtime/srt/vendor/seccomp/x64/apply-seccompView file

•path = [redacted]-seccomp kind = native_binary sizeBytes = 755720 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/runtime/srt/vendor/seccomp/x64/apply-seccompView on unpkg

bin/vm-hands/vm-hands-entry-lite-xz9w76j7.jsView file

•matchType = normalized_sha256 matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.401 matchedPath = bin/vm-hands/vm-hands-entry-lite-xz9w76j7.js matchedIdentity = npm:[redacted]:0.2.401 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High