@reason-machines/cli-linux-x64@0.2.505
Reason CLI native binary for linux-x64
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe endpoint is Reason's first-party API, but the runtime automatically sends saved third-party access tokens there by default without affirmative recipient-specific consent. This is concrete credential disclosure and warrants blocking.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A connected worker starts with the default local-login setting.
Impact
Reason's service receives access tokens for separate provider accounts, exposing those accounts to use through the service.
Mechanism
The runtime reads saved provider credentials, keeps the access tokens, and sends them to the local-subscription API.
Attack narrative
When a connected worker starts, the default-enabled local-login behavior reads saved access tokens for third-party coding services and sends them to Reason's local-subscription API. The code filters out refresh tokens, but the transfer is automatic and the setting is enabled by default. Disclosure of the feature and an opt-out do not establish affirmative, recipient-specific consent to export those credentials.
AI rationale
The endpoint is Reason's first-party API, but the runtime automatically sends saved third-party access tokens there by default without affirmative recipient-specific consent. This is concrete credential disclosure and warrants blocking.
Evidence
bin/vm-hands/vm-hands-entry-lite-0572m6cr.jsbin/vm-hands/vm-hands-entry-lite-vqr3zrqr.jsbin/vm-hands/vm-hands-entry-lite-p9fwt68c.jsbin/vm-hands/vm-hands-entry-lite-e1xjfj57.js~/.claude/.credentials.json$CODEX_HOME/auth.json~/.grok/auth.json~/.local/share/opencode/auth.json
Network endpoints2
api.reasonmachines.aiapi.reasonmachines.com
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The runtime reads saved Claude, Codex, Grok, and OpenCode authentication data and extracts provider access tokens.
- It removes refresh-token fields, then sends each provider access token in a local-subscription request.
- The runtime starts this handover when local logins are enabled; a missing setting defaults to enabled.
- The request uses the package's Reason API destination and the local-subscription route.
- The handover forwards current access tokens, not refresh tokens.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
24 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${q})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=HH((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(N===1)return[];throw Error(`ripgrep failed with exit code ${N}: ${H}`)}import{join as q0,dirname as bH}from"path";import{fileURLToPath as hH}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"er...
L57: `)),$.end(qH(W))}function j7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function VH($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)...
...
L60: mux backend dial failed (${q})
L61: `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=HH((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on(...
L62: `).filter(Boolean);if(N===1)return[];throw Error(`ripgrep failed with exit code ${N}: ${H}`)}import{join as q0,dirname as bH}from"path";import{fileURLToPath as hH}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical21 High6 Medium4 Low
CriticalRemote Asset Decode Executebin/vm-hands/index-h6xkz48h.js
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighShell
HighEvalbin/vm-hands/vm-hands-entry-lite-e4hwb89r.js
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighObfuscated Payload Loaderbin/vm-hands/index-h6xkz48h.js
HighExternal Ai Agent Control Surface Mutationbin/vm-hands/index-h6xkz48h.js
HighCross File Remote Execution Contextbin/vm-hands/vm-hands-executor-6tncheya.js
HighSemantic Analysis Limitedbin/vm-hands/index-h6xkz48h.js
High
Affected versions and remediation
This report applies to @reason-machines/cli-linux-x64@0.2.505.
See all versions of @reason-machines/cli-linux-x64 for other recorded verdicts.
- Avoid installing @reason-machines/cli-linux-x64@0.2.505. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.