registry / @reason-machines/cli-linux-x64 / 0.2.382
@reason-machines/cli-linux-x64@0.2.382
⚠ Under reviewReason CLI native binary for linux-x64
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe inspected credential handover is gated by an explicit localLogins setting and uses the package's Reason service client. However, the 103 MB native executable has only bounded embedded-source analysis, which cannot establish its full behavior; manual review is needed to resolve that material uncertainty.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The CLI's native executable runs; credential handover in the inspected runtime requires localLogins to be enabled.
Impact
The inspected handover can expose enabled local credentials to the Reason service; unresolved native behavior prevents a clean determination.
Mechanism
The JavaScript handover path reads local coding-agent credentials and submits them through the Reason service client when enabled. The native executable's full behavior could not be resolved from the available structural analysis.
AI rationale
The inspected credential handover is gated by an explicit localLogins setting and uses the package's Reason service client. However, the 103 MB native executable has only bounded embedded-source analysis, which cannot establish its full behavior; manual review is needed to resolve that material uncertainty.
Evidence
.lpm-inspection-DArDB3/0-2ca403601580.txtbin/arabin/vm-hands/vm-hands-entry-lite-245929bs.jsbin/vm-hands/vm-hands-entry-lite-3n3xh0xv.js
Network endpoints4
api.reasonmachines.aistaging-api.reasonmachines.aiapi.reasonmachines.comstaging-api.reasonmachines.com
Decision evidence
public snapshotAI called this Manual Review at 91.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package is a Linux x64 native binary package, and its executable has only bounded embedded-source analysis; that analysis cannot establish loader reachability or rule out other native behavior.
- The JavaScript runtime gates local credential handover on localLogins being explicitly true; its client sends the subscription request through the Reason service API.
- The inspected package manifest contains no lifecycle scripts.
Evidence against
- The credential handover flag is an explicit runtime setting, and the inspected caller invokes handover only when that setting is true.
- The credential request uses the package's Reason service client and configured production or staging service endpoints.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
23 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er...
L57: `)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)...
...
L60: mux backend dial failed (${H})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
2 Critical18 High6 Medium4 Low
CriticalRemote Asset Decode Executebin/vm-hands/index-7f2kwwen.js
CriticalPrevious Version Dangerous Deltabin/vm-hands/vm-hands-entry-lite-mn64e4pt.js
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighShellbin/vm-hands/vm-hands-entry-lite-245929bs.js
HighEvalbin/vm-hands/vm-hands-entry-lite-zjfr0zh8.js
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighObfuscated Payload Loaderbin/vm-hands/index-7f2kwwen.js
HighExternal Ai Agent Control Surface Mutationbin/vm-hands/index-7f2kwwen.js
HighCross File Remote Execution Contextbin/vm-hands/vm-hands-entry-lite-cwe16c51.js
Affected versions and remediation
This report applies to @reason-machines/cli-linux-x64@0.2.382.
See all versions of @reason-machines/cli-linux-x64 for other recorded verdicts.
- Review the evidence and your use of @reason-machines/cli-linux-x64@0.2.382 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.