registry / @reason-machines/cli-win32-x64 / 0.2.451
@reason-machines/cli-win32-x64@0.2.451
⚠ Under reviewReason CLI native binary for win32-x64
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe executable analysis reveals a concerning candidate credential-forwarding path with a default-enabled caller, but its bounded source windows do not establish reachability or the recipient. Manual review is needed to resolve those material facts; the agent-related JavaScript location is only used to exclude those directories from file searches.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The candidate caller starts when local login sharing is enabled; the inspected fallback enables it by default.
Impact
If reachable, this could disclose third-party service credentials to the configured API recipient. The recipient and executable reachability remain unresolved.
Mechanism
Candidate code reads credentials from environment variables and local credential stores, then submits discovered access credentials through an authenticated local-subscription request using the worker API origin.
AI rationale
The executable analysis reveals a concerning candidate credential-forwarding path with a default-enabled caller, but its bounded source windows do not establish reachability or the recipient. Manual review is needed to resolve those material facts; the agent-related JavaScript location is only used to exclude those directories from file searches.
Evidence
.lpm-inspection-8Kv44T/0-9b10715fe0db.txt
Decision evidence
public snapshotAI called this Manual Review at 93.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest identifies the requested package and version.
- Bounded executable analysis contains candidate code that collects third-party credentials from environment variables and local credential stores.
- Candidate code repeatedly submits discovered access credentials through an authenticated local-subscription request using the worker API origin.
- The credential-forwarding path is enabled when local login sharing is true, and the inspected configuration fallback sets it to true by default.
- The offline executable analysis explicitly says its bounded source windows do not establish whether the candidate code is reachable.
- The flagged agent-related location lists command and agent directories that the sandbox runtime excludes from a file-search command.
Evidence against
- The manifest has no lifecycle scripts, and the inspected JavaScript bundle contains sandbox-runtime behavior rather than a demonstrated credential-transfer caller.
- The candidate credential-transfer code has a boolean setting that can disable it, but the inspected fallback enables it by default.
Behavioral surface
Source & flagged code
7 flagged · loading sourcebin/runtime/srt/sandbox-runtime.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @reason-machines/cli-win32-x64@0.2.388
matchedIdentity = npm:[redacted]:0.2.388
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg60mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*...
High
Child Process
Package source references child process execution.
bin/runtime/srt/sandbox-runtime.mjsView on unpkg · L6055\r
L56: `)}}),t.on("request",async(r,i)=>{r.on("error",(s)=>{C(`Client request error: ${s.message}`,{level:"error"})}),i.on("error",(s)=>{C(`Client response error: ${s.message}`,{level:"er...
L57: `)),e.end(cx(a))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(a)=>{e.off("data",s),clearTimeout(i),t(a)...
...
L60: mux backend dial failed (${d})
L61: `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on(...
L62: `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*
Findings
1 Critical5 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltabin/runtime/srt/sandbox-runtime.mjs
HighChild Processbin/runtime/srt/sandbox-runtime.mjs
HighSame File Env Network Executionbin/runtime/srt/sandbox-runtime.mjs
HighCommand Output Exfiltrationbin/runtime/srt/sandbox-runtime.mjs
HighKnown Malware Source Similaritybin/runtime/srt/sandbox-runtime.mjs
HighKnown Malware Source Fingerprint Signaturebin/runtime/srt/sandbox-runtime.mjs
MediumEnvironment Vars
MediumShips Native Binarybin/native/win32/prebuilds/win32-x64/win32-platform.node
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @reason-machines/cli-win32-x64@0.2.451.
See all versions of @reason-machines/cli-win32-x64 for other recorded verdicts.
- Review the evidence and your use of @reason-machines/cli-win32-x64@0.2.451 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.