registry / @reason-machines/cli-linux-x64 / 0.2.415
@reason-machines/cli-linux-x64@0.2.415
⚠ Under reviewReason CLI native binary for linux-x64
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install lifecycle, and the inspected agent-related source shows scanning exclusions and an explicit CLI skill-install command. The shipped native executable's behavior remains materially unresolved, so the source evidence does not support a clean or malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Running the package's native executable.
Impact
Unknown; the inspected evidence does not establish a concrete harmful effect.
Mechanism
The available offline analysis samples embedded source but does not establish which samples are reachable or whether other behavior exists.
AI rationale
The manifest has no install lifecycle, and the inspected agent-related source shows scanning exclusions and an explicit CLI skill-install command. The shipped native executable's behavior remains materially unresolved, so the source evidence does not support a clean or malicious verdict.
Evidence
bin/reason.lpm-inspection-kGy1ty/0-08e55e2e9c6e.txt
Decision evidence
public snapshotAI called this Manual Review at 94.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest identifies this as a Linux x64 native-binary package and defines no lifecycle hooks.
- The sandbox runtime's cited paths are exclusions for project scanning, including selected agent directories.
- The VM bundle installs a trace skill under the current project's .claude directory through an explicit install-skill command.
- The native executable's offline analysis contains bounded embedded-source samples and says they cannot establish loader reachability or rule out other behavior.
Evidence against
- No concrete attack behavior was established in the inspected source excerpts. The bounded native analysis is insufficient to determine the executable's full behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
13 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{a.add(l),l.once("close",()=>a.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(a)=>{C(`Client request error: ${a.message}`,{level:"error"})}),i.on("error",(a)=>{C(`Client response error: ${a.message}`,{level:"er...
L57: `)),e.end(cx(s))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(s)=>{e.off("data",a),clearTimeout(i),t(s)...
...
L60: mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{a.add(l),l.once("close",()=>a.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L5547\r
L48: Connection blocked by network allowlist`);return}if(s||i.destroyed){i.destroy();return}let R=_t(E)??E;if(e.mitmCA&&(e.shouldTerminateTLS?.(R,k)??!0)){i.write(`HTTP/1.1 200 Connecti...
L49: \r
...
L55: \r
L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(a)=>{C(`Client request error: ${a.message}`,{level:"error"})}),i.on("error",(a)=>{C(`Client response error: ${a.message}`,{level:"er...
L57: `)),e.end(cx(s))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(s)=>{e.off("data",a),clearTimeout(i),t(s)...
...
L60: mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{a.add(l),l.once("close",()
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L47•matchType = normalized_sha256
matchedPackage = @reason-machines/cli-darwin-arm64@0.2.410
matchedPath = bin/runtime/srt/sandbox-runtime.mjs
matchedIdentity = npm:[redacted]:0.2.410
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/runtime/srt/sandbox-runtime.mjsView on unpkgbin/vm-hands/index-k8kcz8a3.jsView file
1// @bun
L2: import{Yr}from"./vm-hands-entry-lite-6aeea05q.js";import{mi,he,e}from"./vm-hands-entry-lite-0xrsph3r.js";var Ce=he(function(C6,ly){var __dirname="/[redacted]...
L3: `)!=-1,y=this._styles,E=y.length;while(E--){var S=s[y[E]];if(g=S.open+g.replace(S.closeRe,S.open)+S.close,b)g=g.replace(a,function(x){return S.close+x+S.open})}return g}n.setTheme=...
L4: `).join(`
L5: `+_),p.push(w+"m+"+r.exports.humanize(this.diff)+"\x1B[0m")}else p[0]=a()+f+" "+p[0]}function a(){if(t.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}function l(...
L6: `)}function c(p){if(p)process.env.DEBUG=p;else delete process.env.DEBUG}function u(){return process.env.DEBUG}function d(p){p.inspectOpts={};let f=Object.keys(t.inspectOpts);for(le...
...
L8: `:`
L9: `,p=d.whitespace?" = ":"=",f=
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
bin/vm-hands/index-k8kcz8a3.jsView on unpkg · L1271`).map((i)=>i+`
L272: `);if(r)n.pop();else n.push(n.pop().slice(0,-1));return n}function _C(t){let r=[],n,i;for(let s=0;s<t.length;s++){if(n=t[s],n.added)i=1;else if(n.removed)i=-1;else i=0;r.push([i,n....
L273: `)}var Oi=(t)=>(r,n,i,s)=>{let o=i?Object.assign(i,{async:!1}):{async:!1},a=r._zod.run({value:n,issues:[]},o);if(a instanceof Promise)throw new Gr;if(a.issues.length){let l=new(s?....
High
Eval
Package source references dynamic code evaluation.
bin/vm-hands/index-k8kcz8a3.jsView on unpkg · L271239`,CHAR_NO_BREAK_SPACE:"\xA0",CHAR_PERCENT:"%",CHAR_PLUS:"+",CHAR_QUESTION_MARK:"?",CHAR_RIGHT_ANGLE_BRACKET:">",CHAR_RIGHT_CURLY_BRACE:"}",CHAR_RIGHT_SQUARE_BRACKET:"]",CHAR_SEMICO...
L240: GFS4: `),console.error(g)};if(!n[l]){if(p=global[l]||[],d(n,p),n.close=function(g){function b(y,E){return g.call(n,y,function(S){if(!S)w();if(typeof E==="function")E.apply(this,arg...
L241: `:""},this._extScope=D,this._scope=new n.Scope({parent:D}),this._nodes=[new v]}toString(){return this._root.render(this.opts)}name(D){return this._scope.name(D)}scopeName(D){return...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
bin/vm-hands/index-k8kcz8a3.jsView on unpkg · L239•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
race/tracescreenshot.ts"(){init_traceutils2()}});async function traceattachments(){let t=await loadtrace();if(!t.model.attachments.length){console.log(" no attachments");return}console.log(` ${"#".padstart(4)} ${"name".padend(40)} ${"content-type".padend(30)} ${"action".padend(8)}`),console.log(` ${"\u2500".repeat(4)} ${"\u2500".repeat(40)} ${"\u2500".repeat(30)} ${"\u2500".repeat(8)}`);for(let r=0;r<t.model.attachments.length;r++){let n=t.model.attachments[r],i=t.callidtoordinal.get(n.callid);console.log(` ${(r+1+".").padstart(4)} ${n.name.padend(40)} ${n.contenttype.padend(30)} ${(i!==void 0?string(i):n.callid).padend(8)}`)}}async function traceattachment(t,r){let n=await loadtrace(),i=parseint
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/vm-hands/index-k8kcz8a3.jsView on unpkg1Cross-file remote execution chain: bin/vm-hands/index-k8kcz8a3.js spawns bin/vm-hands/vm-hands-entry-lite-6aeea05q.js; helper contains network access plus dynamic code execution.
L1: // @bun
L2: import{Yr}from"./vm-hands-entry-lite-6aeea05q.js";import{mi,he,e}from"./vm-hands-entry-lite-0xrsph3r.js";var Ce=he(function(C6,ly){var __dirname="/[redacted]...
L3: `)!=-1,y=this._styles,E=y.length;while(E--){var S=s[y[E]];if(g=S.open+g.replace(S.closeRe,S.open)+S.close,b)g=g.replace(a,function(x){return S.close+x+S.open})}return g}n.setTheme=...
L4: `).join(`
L5: `+_),p.push(w+"m+"+r.exports.humanize(this.diff)+"\x1B[0m")}else p[0]=a()+f+" "+p[0]}function a(){if(t.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}function l(...
L6: `)}function c(p){if(p)process.env.DEBUG=p;else del
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/vm-hands/index-k8kcz8a3.jsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 3
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bin/vm-hands/index-k8kcz8a3.jsView on unpkg2import{Yr}from"./vm-hands-entry-lite-6aeea05q.js";import{mi,he,e}from"./vm-hands-entry-lite-0xrsph3r.js";var Ce=he(function(C6,ly){var __dirname="/[redacted]...
L3: `)!=-1,y=this._styles,E=y.length;while(E--){var S=s[y[E]];if(g=S.open+g.replace(S.closeRe,S.open)+S.close,b)g=g.replace(a,function(x){return S.close+x+S.open})}return g}n.setTheme=...
L4: `).join(`
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/vm-hands/index-k8kcz8a3.jsView on unpkg · L2bin/vm-hands/vm-hands-entry-lite-cc2tgsqp.jsView file
1// @bun
L2: import{C}from"./vm-hands-entry-lite-t7an5zg2.js";import{g}from"./vm-hands-entry-lite-ckv17tn8.js";import{Nr,Pn,Lr,Tn}from"./vm-hands-entry-lite-qysyf65v.js";import{Ln,Ut,lo}from"./...
L3: <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
L4: <RegistrationInfo>
...
L35: </Task>
L36: `}function V(r){return Buffer.concat([Buffer.from([255,254]),Buffer.from(r.replaceAll(`\r
L37: `,`
...
L44: `))}function G(r,e=process.pid){let n=de(x("powershell.exe"),E(["$all = @{}; Get-CimInstance Win32_Process | % { $all[[int]$_.ProcessId] = $_ }",`$p = $all[${Math.trunc(e)}]`,"for ...
L45: `)),{stdio:"ignore",timeout:15000,windowsHide:!0});return n.status===10?!0:n.status===11?!1:null}var Ir="REASON_WORKER_SERVICE",Ie="worker_identity_unavailable";function b
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
bin/vm-hands/vm-hands-entry-lite-cc2tgsqp.jsView on unpkg · L1bin/runtime/srt/vendor/seccomp/x64/apply-seccompView file
•path = [redacted]-seccomp
kind = native_binary
sizeBytes = 755720
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
bin/runtime/srt/vendor/seccomp/x64/apply-seccompView on unpkgFindings
1 Critical10 High6 Medium4 Low
CriticalRemote Asset Decode Executebin/vm-hands/index-k8kcz8a3.js
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighShell
HighEvalbin/vm-hands/index-k8kcz8a3.js
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighObfuscated Payload Loaderbin/vm-hands/index-k8kcz8a3.js
HighExternal Ai Agent Control Surface Mutationbin/vm-hands/index-k8kcz8a3.js
HighCross File Remote Execution Contextbin/vm-hands/index-k8kcz8a3.js
HighSemantic Analysis Limitedbin/vm-hands/index-k8kcz8a3.js
HighKnown Malware Source Similaritybin/runtime/srt/sandbox-runtime.mjs
MediumDynamic Requirebin/vm-hands/index-k8kcz8a3.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/vm-hands/vm-hands-entry-lite-cc2tgsqp.js
MediumShips Native Binarybin/runtime/srt/vendor/seccomp/x64/apply-seccomp
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @reason-machines/cli-linux-x64@0.2.415.
See all versions of @reason-machines/cli-linux-x64 for other recorded verdicts.
- Review the evidence and your use of @reason-machines/cli-linux-x64@0.2.415 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.