registry / Data exfiltration / @ory/amp

@ory/amp

Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing

This report shows the evidence for @ory/amp@1.5.3. 2 of 18 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

@ory/amp configures an enabled telemetry dependency with a fixed recipient, and the dependency runs its tracker from postinstall. The automatic collection and transmission of installation and host metadata supports blocking this release.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing @ory/amp with dependency lifecycle scripts enabled.

Impact

Installation identifiers and environment details are disclosed to the configured telemetry recipient without installer consent established in the inspected source.

Mechanism

reova postinstall runs a tracker that collects package and system details and posts the payload to telemetry.reo.dev.

Attack narrative

During installation, the reova dependency’s postinstall starts tracking. @ory/amp configures telemetry.reo.dev and enables tracking. The tracker collects package and host details, including system attributes and installation metadata, then posts them to that endpoint. The inspected source does not establish installer consent for this automatic disclosure.

AI rationale

Evidence

package.json.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/package.json.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/index.js.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/tracker.js.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/collector.js.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/sender.js~/.gitconfig

Network endpoints1

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package depends on reova, whose manifest runs node index.js during postinstall; that entrypoint starts tracking automatically.
The parent package enables reova and configures telemetry.reo.dev as the endpoint, without installer consent being established in the inspected source.
The tracker sends for dependent packages when enabled and an endpoint is configured.
The install payload includes package and version, platform, architecture, Node version, OS type and release, CPU count, timestamp, CI status, and a random install identifier.
The sender makes an HTTP request and writes the collected payload to it.

Evidence against

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 37.0 KB of source, external domains: agents.console.ory.com

Source & flagged code

8 flagged

dist/cli/setup.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst to = typeof rec.to === "string" ? rec.to : ""; return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to); } function mergepermissions(existing, to) { const merged = { ...existing }; const perms = (array.isarray(merged["amp.permissions"]) ? merged["amp.permissions"] : []).filter((e) => !isorydelegate(e)); perms.push(delegateentry(to)); merged["amp.permissions"] = perms; return merged; } function removepermissions(existing) { const merged = { ...existing };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

dist/cli/main.jsView file

•matchType = normalized_sha256 matchedPackage = @ory/amp@1.5.2 matchedPath = dist/cli/main.js matchedIdentity = npm:QG9yeS9hbXA:1.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/main.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e48bee076967d0d8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @ory/amp@1.5.2 matchedPath = dist/cli/main.js matchedIdentity = npm:QG9yeS9hbXA:1.5.2 similarity = 1.000 shingleOverlap = 6 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli/main.jsView on unpkg

.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/package.jsonView file

1{ "name": "reova", "version": "0.7.0", "description": "Opt-in npm install analytics: sends install metrics to an endpoint you configure.", "main": "lib.js", "scripts": { "postinstall": "node index.js", "test": "node test-l

High

Suspicious Lifecycle Evidence

The package depends on reova, whose manifest runs node index.js during postinstall; that entrypoint starts tracking automatically.

.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/package.jsonView on unpkg · L1

.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/index.jsView file

8const Tracker = require('./src/tracker'); const START_DELAY_MS = 500; // let sibling packages finish extracting const MAX_WAIT_TIME = 15000; // hard cap before exit function delay(ms) { return new Promise((resolve) => setTimeout(resolve, ms)); } const trackingPromise = delay(START_DELAY_MS) .then(() => new Tracker().track()) .catch(() => { // Never surface errors t

High

Suspicious Lifecycle Evidence

The package depends on reova, whose manifest runs node index.js during postinstall; that entrypoint starts tracking automatically.

.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/index.jsView on unpkg · L8

package.jsonView file

Lines 30-70json

30 "sso",

31 "audit",

32 "audit-log",

33 "compliance",

34 "agent",

35 "ai-agent",

36 "agent-security"

.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/tracker.jsView file

49async trackDependent(dependent) { const pkg = dependent.packageJson; const name = pkg?.name || 'unknown'; if (!this.config.isEnabled(pkg)) { if (this.config.isVerbose()) { console.log(`[reova] ${name}: not opted in (reova.enabled !== true) — skipped`); } return { package: name, success: false, reason: 'not-opted-in' }; } const endpoint = this.config.getEndpoint(pkg); if (!endpoint) { if (this.config.isVerbose()) { console.log(`[reova] ${name}: no valid endpoint configured — skipped`)

High

Suspicious Lifecycle Evidence

The package depends on reova, whose manifest runs node index.js during postinstall; that entrypoint starts tracking automatically.

.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/tracker.jsView on unpkg · L49

.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/collector.jsView file

33return { activity_type: 'npm_install', package: { name, version }, system: { platform: process.platform, // e.g. "darwin" arch: process.arch, // e.g. "arm64" nodeVersion: process.version, // e.g. "v20.11.0" osType: os.type(), osRelease: os.release(), cpuCount: os.cpus().length, }, installation: { timestamp: new Date().toISOString(), ci: this.isCI(), // boolean only — not which provider installId: crypto.randomUUID(), }, tracker: {

High

Ai Review Evidence

The install payload includes package and version, platform, architecture, Node version, OS type and release, CPU count, timestamp, CI status, and a random install identifier.

.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/collector.jsView on unpkg · L33

Source & flagged code

8 flagged · loading source

dist/cli/setup.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

dist/cli/main.jsView file

High

Known Malware Source Similarity

Findings

8 High1 Medium3 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js

HighKnown Malware Source Similaritydist/cli/main.js

HighKnown Malware Source Fingerprint Signaturedist/cli/main.js

HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/package.json

HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/index.js

HighAi Review Evidencepackage.json

HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/tracker.js

HighAi Review Evidence.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/collector.js

MediumEnvironment Vars

Affected versions and remediation

This report applies to @ory/amp@1.5.3.

The versions list below shows the verdict for each recorded version.

Avoid installing @ory/amp@1.5.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 21:31:32.258Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

18 known versions

1.5.3latestshownMaliciousData ExfiltrationBlockPublishedOct 22, 2026, 9:29 PM 1.5.2MaliciousMalwareBlockPublishedOct 22, 2026, 6:34 PM 1.5.1SuspiciousData ExfiltrationWarnPublishedOct 21, 2026, 3:41 PM 1.5.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 7, 2026, 11:19 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Source & flagged code

Related packages

Other data exfiltration packages