Fake REA copies and how to install REA safely

Unofficial guide. This site is an independent community guide and is not affiliated with the REA project. For authoritative docs see the official REA website and the morluto/rea GitHub repository. Commands here are taken from the official README/docs (checked 2026-10-19); REA changes quickly, so verify against the official docs.

REA got popular fast, and copies followed. This page lists only documented cases and the official ways to get REA.

The only official sources

The official README says: "Get REA from morluto/rea, rea.tools, or the rea-agents npm package. ... A similar repository name or copied README does not establish that a download is official." (README)

• GitHub: github.com/morluto/rea
• Website: rea.tools
• npm: rea-agents, installed with npx rea-agents setup

Case 1: fake repo rea-tools/rea with a trojan Windows exe

On October 13, 2026, issue #2424 on morluto/rea reported that github.com/rea-tools/rea was a copy of the project that distributes malware. According to the report:

• It copied REA's README and added a "Windows Standalone .exe / GUI" section linking to a release named "rea-agents: v6.3.0".
• The release served rea-x64.7z (82.6 MB, SHA-256 64116f55779f1a30250aa2497ada9199221d0f867f98575359a5c5cefa9b78a3), downloaded 172 times at the time of the report.
• Microsoft Defender flagged it as Trojan:Win32/Wacatac.B!ml; VirusTotal showed 8 of 45 engines flagging it.
• The organization name "rea-tools" looks like the official site rea.tools.

The issue was closed on October 13, and the official README now carries the official-sources notice quoted above. The rea-tools/rea URL returns 404 as of October 17, 2026.

REA has no official standalone Windows .exe download. On Windows, install it through npm (Windows guide). If you ran rea-x64.exe from that repo, treat the machine as compromised: run a full antivirus scan and change passwords from a clean device.

Case 2: "REA" crypto tokens

Tokens using the REA name have appeared, including a Solana token launched on pump.fun. The README in the official npm package (rea-agents 6.4.0) states: "REA is an open-source software project. We have not issued or endorsed any cryptocurrency or token. Tokens using the REA name are not affiliated with the project."

So any "official REA coin", airdrop or presale is not from the REA project. Never connect a wallet or send funds because of a post that claims otherwise.

Safe-install checklist

1. Start from github.com/morluto/rea or rea.tools, not from a search ad or a lookalike name.
2. Install with npx rea-agents setup or npm install --global rea-agents. The package name is exactly rea-agents.
3. Check the package before installing: npm view rea-agents repository.url should point to github.com/morluto/rea.
4. Don't run .exe, .7z or installer files from other repos or file hosts.
5. Check the owner in the URL: morluto/rea, not rea-tools/rea or other lookalikes. A copied README and star count prove nothing.
6. Ignore "REA token", airdrop or wallet-connect requests. The project has disowned tokens.
7. Suspicious copy? Report it to GitHub and mention it in an issue on morluto/rea.

Related guides

• Install REA
• Install REA on Windows
• REA in Perplexity Computer (/reverse-engineer)
• Troubleshooting & FAQ

Sources: issue #2424 · official README · rea-agents 6.4.0 README (token notice) · VirusTotal report

FAQ