registry / Credential exfiltration / @reason-machines/cli-linux-x64-musl / 0.2.545

@reason-machines/cli-linux-x64-musl@0.2.545

Reason CLI native binary for linux-x64-musl

AI Security Review

scanned 5h ago · by lpm-firewall-ai

The inspected source shows default-on transfer of existing third-party access tokens to Reason's service. This is concrete credential disclosure to a publisher-selected recipient, so the package should be blocked.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Starting a worker with the default local-login setting enabled.

Impact

Reason's backend receives access tokens for accounts at other providers, allowing their use in the advertised session feature.

Mechanism

The worker reads saved provider credentials and forwards current access tokens to the Reason local-subscription endpoint without a separate recipient-specific opt-in.

Attack narrative

When the worker starts, its default configuration enables local-login handover. The native CLI reads saved credentials for supported providers and sends current access tokens to Reason's local-subscription endpoint. The code documents the feature, but the transfer goes to Reason rather than the providers that issued those credentials, with no separate affirmative recipient choice.

AI rationale

Evidence

.lpm-inspection-te5mi2/0-f50bd65cb3df.txtbin/vm-hands/vm-hands-entry-lite-4anjdcth.jsbin/reason

Network endpoints4

api.reasonmachines.aistaging-api.reasonmachines.aiapi.reasonmachines.comstaging-api.reasonmachines.com

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

Hash-verified offline analysis of the native CLI contains the credential collection and handover code; the analysis notes that embedded-source reachability is bounded.
The CLI reads existing provider login credentials from local stores, including OAuth access tokens.
When enabled, the worker sends collected login data through the Reason local-subscription request.
The worker invokes that handover at startup when local logins are enabled; the configuration defaults to enabled, and the CLI describes it as on by default.
The Reason API endpoints are package-owned service hosts, while the transferred credentials belong to other providers.

Evidence against

The CLI presents local-login support as a session feature and says it transfers current access tokens rather than refresh tokens; that description does not provide a separate affirmative choice to send those credentials to Reason.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEval

Source & flagged code

24 flagged

bin/runtime/srt/sandbox-runtime.mjsView file

60mux backend dial failed (${d}) L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=px((l)=>{a.add(l),l.once("close",()=>a.delete(l)),l.on(... L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as dr,dirname as Vx}from"path";import{fileURLToPath as Fx}from"url";import*...

High

Child Process

Package source references child process execution.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L60

55\r L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(a)=>{C(`Client request error: ${a.message}`,{level:"error"})}),i.on("error",(a)=>{C(`Client response error: ${a.message}`,{level:"er... L57: `)),e.end(fx(s))}function _l(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function dx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(s)=>{e.off("data",a),clearTimeout(i),t(s)... ... L60: mux backend dial failed (${d}) L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=px((l)=>{a.add(l),l.once("close",()=>a.delete(l)),l.on(... L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as dr,dirname as Vx}from"path";import{fileURLToPath as Fx}from"url";import*

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L55

47\r L48: Connection blocked by network allowlist`);return}if(s||i.destroyed){i.destroy();return}let R=_t(E)??E;if(e.mitmCA&&(e.shouldTerminateTLS?.(R,k)??!0)){i.write(`HTTP/1.1 200 Connecti... L49: \r ... L55: \r L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(a)=>{C(`Client request error: ${a.message}`,{level:"error"})}),i.on("error",(a)=>{C(`Client response error: ${a.message}`,{level:"er... L57: `)),e.end(fx(s))}function _l(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function dx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(s)=>{e.off("data",a),clearTimeout(i),t(s)... ... L60: mux backend dial failed (${d}) L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=px((l)=>{a.add(l),l.once("close",()

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L47

bin/vm-hands/vm-hands-entry-lite-dszmx6yf.jsView file

1// @bun L2: import{ys}from"./vm-hands-entry-lite-pzj5s203.js";var Xr,Xo=Object.freeze({status:"aborted"});function z(e,r,a){function p(h,_){if(!h._zod)Object.defineProperty(h,"_zod",{value:{de... L3: `).filter((f)=>f),p=Math.min(...a.map((f)=>f.length-f.trimStart().length)),l=a.map((f)=>f.slice(p)).map((f)=>" ".repeat(this.indent*2)+f);for(let f of l)this.content.push(f)}compil...

High

Eval

Package source references dynamic code evaluation.

bin/vm-hands/vm-hands-entry-lite-dszmx6yf.jsView on unpkg · L1

bin/vm-hands/index-gmsadq51.jsView file

1// @bun L2: import{hn}from"./vm-hands-entry-lite-q1yvw4xz.js";import{Fi,he,e}from"./vm-hands-entry-lite-pzj5s203.js";var Ce=he(function(C6,ly){var __dirname="/[redacted]... L3: `)!=-1,y=this._styles,E=y.length;while(E--){var S=s[y[E]];if(g=S.open+g.replace(S.closeRe,S.open)+S.close,b)g=g.replace(a,function(x){return S.close+x+S.open})}return g}n.setTheme=... L4: `).join(` L5: `+_),p.push(w+"m+"+r.exports.humanize(this.diff)+"\x1B[0m")}else p[0]=a()+f+" "+p[0]}function a(){if(t.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}function l(... L6: `)}function c(p){if(p)process.env.DEBUG=p;else delete process.env.DEBUG}function u(){return process.env.DEBUG}function d(p){p.inspectOpts={};let f=Object.keys(t.inspectOpts);for(le... ... L8: `:` L9: `,p=d.whitespace?" = ":"=",f=

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

bin/vm-hands/index-gmsadq51.jsView on unpkg · L1

239`,CHAR_NO_BREAK_SPACE:"\xA0",CHAR_PERCENT:"%",CHAR_PLUS:"+",CHAR_QUESTION_MARK:"?",CHAR_RIGHT_ANGLE_BRACKET:">",CHAR_RIGHT_CURLY_BRACE:"}",CHAR_RIGHT_SQUARE_BRACKET:"]",CHAR_SEMICO... L240: GFS4: `),console.error(g)};if(!n[l]){if(p=global[l]||[],d(n,p),n.close=function(g){function b(y,E){return g.call(n,y,function(S){if(!S)w();if(typeof E==="function")E.apply(this,arg... L241: `:""},this._extScope=D,this._scope=new n.Scope({parent:D}),this._nodes=[new v]}toString(){return this._root.render(this.opts)}name(D){return this._scope.name(D)}scopeName(D){return...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

bin/vm-hands/index-gmsadq51.jsView on unpkg · L239

bin/vm-hands/vm-hands-entry-lite-ax1rvy38.jsView file

1// @bun L2: import{R}from"./vm-hands-entry-lite-a3p6xz53.js";import{_}from"./vm-hands-entry-lite-4anjdcth.js";import{Jr,ei,Xr,ti}from"./vm-hands-entry-lite-vj7xzb3y.js";import{Yn,er,Fo}from"./... L3: <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> L4: <RegistrationInfo> ... L35: </Task> L36: `}function B(r){return Buffer.concat([Buffer.from([255,254]),Buffer.from(r.replaceAll(`\r L37: `,` ... L44: `))}function X(r,e=process.pid){let n=de(C("powershell.exe"),I(["$all = @{}; Get-CimInstance Win32_Process | % { $all[[int]$_.ProcessId] = $_ }",`$p = $all[${Math.trunc(e)}]`,"for ... L45: `)),{stdio:"ignore",timeout:15000,windowsHide:!0});return n.status===10?!0:n.status===11?!1:null}var Wr="REASON_WORKER_SERVICE",Ae="worker_identity_unavailable";function x

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/vm-hands/vm-hands-entry-lite-ax1rvy38.jsView on unpkg · L1

bin/runtime/srt/vendor/seccomp/x64/apply-seccompView file

•path = [redacted]-seccomp kind = native_binary sizeBytes = 759816 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/runtime/srt/vendor/seccomp/x64/apply-seccompView on unpkg

bin/vm-hands/vm-hands-entry-lite-4r1yn35v.jsView file

•matchType = normalized_sha256 matchedPackage = @reason-machines/cli-linux-x64@0.2.541 matchedPath = bin/vm-hands/vm-hands-entry-lite-4r1yn35v.js matchedIdentity = npm:[redacted]:0.2.541 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High