@reason-machines/cli-win32-arm64@0.2.434
Reason CLI native binary for win32-arm64
AI Security Review
scanned 4d ago · by lpm-firewall-aiSource inspection found conditional forwarding of saved third-party access tokens to the configured Reason API, enabled by default in a configuration path. The feature is disclosed and switchable, but the source does not establish recipient-specific consent for forwarding those credentials.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A Reason local worker starts with local logins enabled; the setting defaults on when no API key is supplied.
Impact
Reason receives current third-party access tokens, creating conditional exposure of those accounts to the configured Reason API.
Mechanism
The CLI reads local provider credential stores and submits discovered logins through the device-authenticated local-subscription endpoint.
AI rationale
Source inspection found conditional forwarding of saved third-party access tokens to the configured Reason API, enabled by default in a configuration path. The feature is disclosed and switchable, but the source does not establish recipient-specific consent for forwarding those credentials.
Evidence
.lpm-inspection-FI0zoB/0-4b0ba2170c93.txtbin/reason.exe
Network endpoints1
/local-subscription on the configured Reason API
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest identifies this as a platform-specific native Reason CLI package.
- The flagged sandbox runtime lists protected agent configuration locations; the inspected excerpt shows no configuration write.
- Embedded executable source reads saved local-login credentials, including Claude credentials and provider auth files.
- The executable defines a device-authenticated `/local-subscription` endpoint and calls it with each discovered provider login.
- A running worker hands local logins to that endpoint when `localLogins` is enabled; configuration defaults that option on unless an API key is supplied.
- The CLI help says Reason receives each login's current access token and offers an off setting.
Evidence against
- The transfer is tied to the product’s local-login feature, is disclosed in its CLI help, excludes refresh tokens, and can be disabled.
- The inspected source does not establish credential misuse beyond forwarding tokens to the configured Reason API.
Behavioral surface
ChildProcessCrypto
Source & flagged code
6 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
60mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(s)=>{C(`Client request error: ${s.message}`,{level:"error"})}),i.on("error",(s)=>{C(`Client response error: ${s.message}`,{level:"er...
L57: `)),e.end(cx(a))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(a)=>{e.off("data",s),clearTimeout(i),t(a)...
...
L60: mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
5 High3 Medium4 Low
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighKnown Malware Source Similaritybin/runtime/srt/sandbox-runtime.mjs
HighKnown Malware Source Fingerprint Signaturebin/runtime/srt/sandbox-runtime.mjs
MediumEnvironment Vars
MediumShips Native Binarybin/native/win32/prebuilds/win32-arm64/win32-platform.node
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @reason-machines/cli-win32-arm64@0.2.434.
See all versions of @reason-machines/cli-win32-arm64 for other recorded verdicts.
- Review the evidence and your use of @reason-machines/cli-win32-arm64@0.2.434 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.