@reason-machines/cli-linux-x64@0.2.371
Reason CLI native binary for linux-x64
AI Security Review
scanned 5d ago · by lpm-firewall-aiSource inspection confirms an automatic transfer of saved third-party access tokens to a package-selected service endpoint, with local logins enabled by default and no recipient-specific consent gate. This supports blocking the package for credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Starting the connected CLI with local logins enabled.
Impact
Existing third-party access tokens are disclosed to the Reason service without recipient-specific consent.
Mechanism
The CLI reads saved agent tokens and repeatedly submits them through the local-subscription API request.
Attack narrative
When the connected CLI runs with its default local-login setting, it reads saved access tokens for coding-agent accounts and periodically sends them to the Reason API. The code does not obtain recipient-specific consent before forwarding these existing credentials.
AI rationale
Source inspection confirms an automatic transfer of saved third-party access tokens to a package-selected service endpoint, with local logins enabled by default and no recipient-specific consent gate. This supports blocking the package for credential exfiltration.
Evidence
bin/vm-hands/vm-hands-entry-lite-kc07ptqt.jsbin/vm-hands/vm-hands-entry-lite-2fyemnas.jsbin/vm-hands/vm-hands-entry-lite-8cmyg5e4.jsbin/vm-hands/vm-hands-entry-lite-gzyps3ev.js
Network endpoints1
api.reasonmachines.ai/app/local-runtime/local-subscription
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI collects saved access tokens from coding-agent login stores.
- The local-login option defaults to enabled and starts a recurring transfer when a local-subscription client is available.
- Each collected token is sent to the Reason API’s local-subscription endpoint.
- The package provides no recipient-specific consent step before sending those existing third-party credentials.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
23 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er...
L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)...
...
L60: mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L5547\r
L48: Connection blocked by network allowlist`);return}if(W||Y.destroyed){Y.destroy();return}let P=jJ(j)??j;if($.mitmCA&&($.shouldTerminateTLS?.(P,C)??!0)){Y.write(`HTTP/1.1 200 Connecti...
L49: \r
...
L55: \r
L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er...
L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)...
...
L60: mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L47bin/vm-hands/index-kf4q2kw5.jsView file
1// @bun
L2: import{Aa as iJ0}from"./vm-hands-entry-lite-nhfd61cx.js";import{ak as NV0,bk as rn,ck as EJ,ek as an,fk as X0}from"./vm-hands-entry-lite-7fx4xtf6.js";var on={};var $T;var WT=an(()=...
L3: `)!=-1,q=this._styles,O=q.length;while(O--){var E=G[q[O]];if(A=E.open+A.replace(E.closeRe,E.open)+E.close,R)A=A.replace($,function(D){return E.close+D+E.open})}return A}X.setTheme=...
L4: `).join(`
L5: `+N),U.push(z+"m+"+Y.exports.humanize(this.diff)+"\x1B[0m")}else U[0]=$()+M+" "+U[0]}function $(){if(Q.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}function W(...
L6: `)}function K(U){if(U)process.env.DEBUG=U;else delete process.env.DEBUG}function H(){return process.env.DEBUG}function B(U){U.inspectOpts={};let M=Object.keys(Q.inspectOpts);for(le...
...
L8: `:`
L9: `,U=B.
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
bin/vm-hands/index-kf4q2kw5.jsView on unpkg · L1271`).map((J)=>J+`
L272: `);if(Y)X.pop();else X.push(X.pop().slice(0,-1));return X}function is(Q){let Y=[],X,J;for(let G=0;G<Q.length;G++){if(X=Q[G],X.added)J=1;else if(X.removed)J=-1;else J=0;Y.push([J,X....
L273: `)}var V$=(Q)=>(Y,X,J,G)=>{let Z=J?Object.assign(J,{async:!1}):{async:!1},$=Y._zod.run({value:X,issues:[]},Z);if($ instanceof Promise)throw new AJ;if($.issues.length){let W=new(G?....
High
Eval
Package source references dynamic code evaluation.
bin/vm-hands/index-kf4q2kw5.jsView on unpkg · L271239`,CHAR_NO_BREAK_SPACE:"\xA0",CHAR_PERCENT:"%",CHAR_PLUS:"+",CHAR_QUESTION_MARK:"?",CHAR_RIGHT_ANGLE_BRACKET:">",CHAR_RIGHT_CURLY_BRACE:"}",CHAR_RIGHT_SQUARE_BRACKET:"]",CHAR_SEMICO...
L240: GFS4: `),console.error(A)};if(!X[W]){if(U=global[W]||[],B(X,U),X.close=function(A){function R(q,O){return A.call(X,q,function(E){if(!E)z();if(typeof O==="function")O.apply(this,arg...
L241: `:""},this._extScope=S,this._scope=new X.Scope({parent:S}),this._nodes=[new F]}toString(){return this._root.render(this.opts)}name(S){return this._scope.name(S)}scopeName(S){return...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
bin/vm-hands/index-kf4q2kw5.jsView on unpkg · L239•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
buffer()),u=await kl(b,v,y.output);console.log(` screenshot saved to ${u}`)}var p50=j0({"packages/playwright-[redacted].ts"(){kx()}});async function n50(){let q=await k7();if(!q.model.attachments.length){console.log(" no attachments");return}console.log(` ${"#".padstart(4)} ${"name".padend(40)} ${"content-type".padend(30)} ${"action".padend(8)}`),console.log(` ${"\u2500".repeat(4)} ${"\u2500".repeat(40)} ${"\u2500".repeat(30)} ${"\u2500".repeat(8)}`);for(let y=0;y<q.model.attachments.length;y++){let x=q.model.attachments[y],j=q.callidtoordinal.get(x.callid);console.log(` ${(y+1+".").padstart(4)} ${x.name.padend(40)} ${x.contenttype.padend(30)} ${(j!==void 0?string(j):x.callid).padend(8)}`)}}asyn
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/vm-hands/index-kf4q2kw5.jsView on unpkg•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 3
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bin/vm-hands/index-kf4q2kw5.jsView on unpkg•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.371
matchedPath = bin/vm-hands/index-kf4q2kw5.js
matchedIdentity = npm:[redacted]:0.2.371
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vm-hands/index-kf4q2kw5.jsView on unpkgbin/vm-hands/vm-hands-entry-lite-b775ysr4.jsView file
•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.371
matchedPath = bin/vm-hands/vm-hands-entry-lite-b775ysr4.js
matchedIdentity = npm:[redacted]:0.2.371
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vm-hands/vm-hands-entry-lite-b775ysr4.jsView on unpkg1// @bun
L2: import{Ac as R}from"./vm-hands-entry-lite-mcv6pse6.js";import{Tc as D}from"./vm-hands-entry-lite-hh24bq0d.js";import{$j as $}from"./vm-hands-entry-lite-y3wncwjd.js";import{spawn as...
L3: export{Cj as uc,Mj as vc,c as wc,_j as xc,p as yc,Sj as zc};
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/vm-hands/vm-hands-entry-lite-b775ysr4.jsView on unpkg · L1bin/vm-hands/vm-hands-executor-676cpsf2.jsView file
1Cross-file remote execution chain: bin/vm-hands/vm-hands-executor-676cpsf2.js spawns bin/vm-hands/vm-hands-entry-lite-dq1fdx0j.js; helper contains network access plus dynamic code execution.
L1: // @bun
L2: import{s as Mq}from"./vm-hands-entry-lite-gteq5e1n.js";import{Lb as Uq,pc as Fq,rb as Lq,tc as Tq}from"./vm-hands-entry-lite-ymwv38dd.js";import"./vm-hands-entry-lite-mcv6pse6.js";...
L3: `).filter(Boolean);B=Z.length;let Y=Q.map((L)=>{try{return Number(JSON.parse(L).elapsed_ms)||0}catch{return 0}});if(Y.length)X("vm_hands.srt_server_starts",{count:Y.length,elapsed_...
L4: `).filter(Boolean).slice(0,1000);if(!Y.length)return null;let L={},F=0;for(let M of Y)try{let R=JSON.parse(M),K=typeof R.code==="string"&&/^[a-z_]{1,40}$/.test(R.code)?R.code:"othe...
L5: `).find((V)=>V.startsWith("0:
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/vm-hands/vm-hands-executor-676cpsf2.jsView on unpkg · L1bin/araView file
•path = bin/ara
kind = native_binary
sizeBytes = 102873216
magicHex = [redacted]
Medium
bin/vm-hands/ask-relay-dq0v3bmt.jsView file
•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.371
matchedPath = bin/vm-hands/ask-relay-dq0v3bmt.js
matchedIdentity = npm:[redacted]:0.2.371
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vm-hands/ask-relay-dq0v3bmt.jsView on unpkgbin/vm-hands/vm-hands-entry-lite-8emxhcny.jsView file
•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.371
matchedPath = bin/vm-hands/vm-hands-entry-lite-8emxhcny.js
matchedIdentity = npm:[redacted]:0.2.371
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vm-hands/vm-hands-entry-lite-8emxhcny.jsView on unpkgbin/vm-hands/vm-hands-entry-lite-e9gq8n0f.jsView file
•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.371
matchedPath = bin/vm-hands/vm-hands-entry-lite-e9gq8n0f.js
matchedIdentity = npm:[redacted]:0.2.371
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vm-hands/vm-hands-entry-lite-e9gq8n0f.jsView on unpkgbin/vm-hands/vm-hands-entry-lite-k7twc1ch.jsView file
•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.371
matchedPath = bin/vm-hands/vm-hands-entry-lite-k7twc1ch.js
matchedIdentity = npm:[redacted]:0.2.371
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vm-hands/vm-hands-entry-lite-k7twc1ch.jsView on unpkgbin/vm-hands/vm-hands-entry-lite-kc07ptqt.jsView file
•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.371
matchedPath = bin/vm-hands/vm-hands-entry-lite-kc07ptqt.js
matchedIdentity = npm:[redacted]:0.2.371
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vm-hands/vm-hands-entry-lite-kc07ptqt.jsView on unpkgbin/vm-hands/status-czgrayjt.jsView file
•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.371
matchedPath = bin/vm-hands/status-czgrayjt.js
matchedIdentity = npm:[redacted]:0.2.371
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vm-hands/status-czgrayjt.jsView on unpkgbin/vm-hands/vm-hands-entry-lite-5n6agg8d.jsView file
•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.371
matchedPath = bin/vm-hands/vm-hands-entry-lite-5n6agg8d.js
matchedIdentity = npm:[redacted]:0.2.371
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vm-hands/vm-hands-entry-lite-5n6agg8d.jsView on unpkgbin/vm-hands/vm-hands-entry-lite-8cmyg5e4.jsView file
•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.371
matchedPath = bin/vm-hands/vm-hands-entry-lite-8cmyg5e4.js
matchedIdentity = npm:[redacted]:0.2.371
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vm-hands/vm-hands-entry-lite-8cmyg5e4.jsView on unpkgbin/vm-hands/vm-hands-entry-lite-cxgbb2yr.jsView file
•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.371
matchedPath = bin/vm-hands/vm-hands-entry-lite-cxgbb2yr.js
matchedIdentity = npm:[redacted]:0.2.371
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vm-hands/vm-hands-entry-lite-cxgbb2yr.jsView on unpkgbin/vm-hands/vm-hands-entry-lite-dq1fdx0j.jsView file
•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-linux-x64-musl@0.2.371
matchedPath = bin/vm-hands/vm-hands-entry-lite-dq1fdx0j.js
matchedIdentity = npm:[redacted]:0.2.371
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/vm-hands/vm-hands-entry-lite-dq1fdx0j.jsView on unpkgFindings
1 Critical21 High5 Medium4 Low
CriticalRemote Asset Decode Executebin/vm-hands/index-kf4q2kw5.js
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighShell
HighEvalbin/vm-hands/index-kf4q2kw5.js
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighObfuscated Payload Loaderbin/vm-hands/index-kf4q2kw5.js
HighExternal Ai Agent Control Surface Mutationbin/vm-hands/index-kf4q2kw5.js
HighCross File Remote Execution Contextbin/vm-hands/vm-hands-executor-676cpsf2.js
HighSemantic Analysis Limitedbin/vm-hands/index-kf4q2kw5.js
HighKnown Malware Source Similaritybin/vm-hands/ask-relay-dq0v3bmt.js
HighKnown Malware Source Similaritybin/vm-hands/index-kf4q2kw5.js
HighKnown Malware Source Similaritybin/vm-hands/vm-hands-entry-lite-8emxhcny.js
HighKnown Malware Source Similaritybin/vm-hands/vm-hands-entry-lite-e9gq8n0f.js
HighKnown Malware Source Similaritybin/vm-hands/vm-hands-entry-lite-k7twc1ch.js
HighKnown Malware Source Similaritybin/vm-hands/vm-hands-entry-lite-kc07ptqt.js
HighKnown Malware Source Similaritybin/vm-hands/status-czgrayjt.js
HighKnown Malware Source Similaritybin/vm-hands/vm-hands-entry-lite-5n6agg8d.js
HighKnown Malware Source Similaritybin/vm-hands/vm-hands-entry-lite-8cmyg5e4.js
HighKnown Malware Source Similaritybin/vm-hands/vm-hands-entry-lite-b775ysr4.js
HighKnown Malware Source Similaritybin/vm-hands/vm-hands-entry-lite-cxgbb2yr.js
HighKnown Malware Source Similaritybin/vm-hands/vm-hands-entry-lite-dq1fdx0j.js
MediumDynamic Requirebin/vm-hands/vm-hands-entry-lite-b775ysr4.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarybin/ara
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @reason-machines/cli-linux-x64@0.2.371.
See all versions of @reason-machines/cli-linux-x64 for other recorded verdicts.
- Avoid installing @reason-machines/cli-linux-x64@0.2.371. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.