registry / Credential exfiltration / @reason-machines/cli-win32-x64
@reason-machines/cli-win32-x64
Reason CLI native binary for win32-x64
This report shows the evidence for @reason-machines/cli-win32-x64@0.2.418. 1 of 96 known versions is blocked or flagged. The newest version, 0.2.546, is allowed. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe native CLI collects existing third-party access tokens and sends them to its configured service API during ordinary worker startup, with local logins enabled by default and no recipient-specific consent gate shown. This is concrete credential disclosure supporting a block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting a local worker with the default local-login setting.
Impact
The service receives credentials that can authorize access to third-party accounts without recipient-specific approval in the inspected path.
Mechanism
The CLI reads saved credentials from local agent stores and sends provider access tokens with expiry data to the local-subscription endpoint.
Attack narrative
During worker startup, the CLI reads saved OAuth credentials from local agent stores and submits access tokens to its configured service API. This happens by default when local logins are enabled, with no recipient-specific approval in the inspected path. The help discloses the feature and says refresh tokens are not sent, but those limits do not establish consent to send saved third-party access tokens.
AI rationale
The native CLI collects existing third-party access tokens and sends them to its configured service API during ordinary worker startup, with local logins enabled by default and no recipient-specific consent gate shown. This is concrete credential disclosure supporting a block.
Evidence
.lpm-inspection-Jv3Xbv/0-b7fd97d8e932.txtbin/reason.exe
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The embedded CLI reads saved OAuth credentials from agent stores and extracts provider access tokens.
- When local logins are enabled, worker startup submits those credentials to the local-subscription request on its API client.
- The configuration defaults local logins to enabled; the embedded help describes Claude Code, Codex, and Grok logins as the sources and says Reason receives their current access tokens.
- The inspected startup path contains no recipient-specific approval before sending saved third-party tokens.
- The flagged sandbox-runtime location lists Claude command and agent directories in a separate local path policy.
- The runtime behavior is in the native CLI; the platform package manifest has no install hook.
Evidence against
- The embedded help says the transfer excludes refresh tokens and offers a way to turn local logins off with an API key.
- The package manifest identifies this as a Windows x64 native package and contains no lifecycle scripts.
Behavioral surface
ChildProcessCrypto
Source & flagged code
6 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @reason-machines/cli-win32-x64@0.2.388
matchedIdentity = npm:[redacted]:0.2.388
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg60mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(s)=>{C(`Client request error: ${s.message}`,{level:"error"})}),i.on("error",(s)=>{C(`Client response error: ${s.message}`,{level:"er...
L57: `)),e.end(cx(a))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(a)=>{e.off("data",s),clearTimeout(i),t(a)...
...
L60: mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*
Findings
1 Critical4 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltabin/runtime/srt/sandbox-runtime.mjs
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighKnown Malware Source Similaritybin/runtime/srt/sandbox-runtime.mjs
MediumEnvironment Vars
MediumShips Native Binarybin/native/win32/prebuilds/win32-x64/win32-platform.node
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @reason-machines/cli-win32-x64@0.2.418.
The versions list below shows the verdict for each recorded version.
- Avoid installing @reason-machines/cli-win32-x64@0.2.418. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.