registry / Credential exfiltration / @reason-machines/cli-win32-arm64
@reason-machines/cli-win32-arm64
Reason CLI native binary for win32-arm64
This report shows the evidence for @reason-machines/cli-win32-arm64@0.2.418. 1 of 100 known versions is blocked or flagged. The newest version, 0.2.547, is allowed. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe bundled CLI extracts existing third-party access tokens and sends them to Reason’s authenticated local-subscription endpoint when local-login syncing is enabled. That setting defaults to enabled, so the verified credential transfer supports a malicious block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Starting a Reason worker with default configuration and without an API key or explicit local-login setting.
Impact
Third-party service access tokens are disclosed to Reason’s API without recipient-specific approval.
Mechanism
The worker reads local credential stores, extracts access tokens, and submits changed token records to the authenticated local-subscription endpoint.
Attack narrative
When a Reason worker starts with default settings, it searches local keychain and authentication files for coding-tool credentials, then sends changed access-token records to Reason’s local-subscription API. The source says syncing is on by default and that Reason receives each login’s current access token; this exposes third-party credentials without recipient-specific approval.
AI rationale
The bundled CLI extracts existing third-party access tokens and sends them to Reason’s authenticated local-subscription endpoint when local-login syncing is enabled. That setting defaults to enabled, so the verified credential transfer supports a malicious block.
Evidence
.lpm-inspection-KrTR6p/0-2bbc28670c89.txt.credentials.json.grok/auth.json.local/share/opencode/auth.json.pi/agent/auth.json
Network endpoints1
/app/local-runtime/local-subscription
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The bundled CLI source reads existing credentials from local keychain and authentication files for coding tools.
- A running worker collects changed credentials and submits them through the local-subscription client.
- The client sends the credential record in the request body to the authenticated local-subscription route.
- The worker starts this collector when local login syncing is enabled; the configuration defaults that setting to enabled when unspecified.
- CLI help says local login syncing is on by default and that Reason receives each login’s current access token.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(s)=>{C(`Client request error: ${s.message}`,{level:"error"})}),i.on("error",(s)=>{C(`Client response error: ${s.message}`,{level:"er...
L57: `)),e.end(cx(a))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(a)=>{e.off("data",s),clearTimeout(i),t(a)...
...
L60: mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
5 High3 Medium4 Low
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighKnown Malware Source Similaritybin/runtime/srt/sandbox-runtime.mjs
HighAi Review Evidence.lpm-inspection-KrTR6p/0-2bbc28670c89.txt
MediumEnvironment Vars
MediumShips Native Binarybin/native/win32/prebuilds/win32-arm64/win32-platform.node
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @reason-machines/cli-win32-arm64@0.2.418.
The versions list below shows the verdict for each recorded version.
- Avoid installing @reason-machines/cli-win32-arm64@0.2.418. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.