registry / @reason-machines/cli-linux-x64-musl / 0.2.410
@reason-machines/cli-linux-x64-musl@0.2.410
⚠ Under reviewReason CLI native binary for linux-x64-musl
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest and inspected agent-path matches do not establish malicious behavior. The required native executable remains materially unresolved: its bounded analysis exposes credential-reading and service-client code but cannot establish reachability or complete data flow, so manual review is appropriate.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Running bin/reason; the exact activation chain is unresolved.
Impact
Credential exposure and other effects remain unverified because the executable analysis does not establish reachability or the complete data flow.
Mechanism
One embedded source window reads provider keys from environment variables and local agent files. Another shows a client method sending caller-provided data to a local-subscription operation.
AI rationale
The manifest and inspected agent-path matches do not establish malicious behavior. The required native executable remains materially unresolved: its bounded analysis exposes credential-reading and service-client code but cannot establish reachability or complete data flow, so manual review is appropriate.
Evidence
bin/reason.lpm-inspection-tFoMTH/0-d998efb3f367.txt
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json identifies a Linux x64 musl native CLI and has no lifecycle script or JavaScript entrypoint.
- The flagged agent paths appear in sandbox policy code; the bundled skill helper copies a Playwright trace skill into the current project.
- The required native executable is an 84 MB ELF. Its hash-bound analysis contains only bounded source windows and says it cannot establish reachability or rule out other behavior.
- An embedded source window reads provider API keys and credentials from local coding-agent configuration.
- A separate embedded client method sends caller-provided data to a local-subscription operation; the available analysis does not resolve whether it is connected to the credential-reading code.
Evidence against
- No install-time lifecycle hook is declared.
- The agent-configuration matches inspected do not establish broad agent configuration mutation.
- The bundled skill helper is scoped to installing a Playwright trace skill.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
12 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{a.add(l),l.once("close",()=>a.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(a)=>{C(`Client request error: ${a.message}`,{level:"error"})}),i.on("error",(a)=>{C(`Client response error: ${a.message}`,{level:"er...
L57: `)),e.end(cx(s))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(s)=>{e.off("data",a),clearTimeout(i),t(s)...
...
L60: mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{a.add(l),l.once("close",()=>a.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical10 High5 Medium4 Low
CriticalRemote Asset Decode Executebin/vm-hands/index-k8kcz8a3.js
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighShell
HighEvalbin/vm-hands/index-k8kcz8a3.js
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighObfuscated Payload Loaderbin/vm-hands/index-k8kcz8a3.js
HighExternal Ai Agent Control Surface Mutationbin/vm-hands/index-k8kcz8a3.js
HighCross File Remote Execution Contextbin/vm-hands/index-k8kcz8a3.js
HighSemantic Analysis Limitedbin/vm-hands/index-k8kcz8a3.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @reason-machines/cli-linux-x64-musl@0.2.410.
See all versions of @reason-machines/cli-linux-x64-musl for other recorded verdicts.
- Review the evidence and your use of @reason-machines/cli-linux-x64-musl@0.2.410 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.