registry / Data exfiltration / @ory/amp / 1.5.1

@ory/amp@1.5.1

Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The dependency performs automatic, consent-unprompted installation telemetry with system and organizational data. Because source inspection does not establish whether the configured collector is unrelated to the package, this remains a warning rather than a confirmed attack.

Static reason

No blocking static signals were detected.

Trigger

Installing @ory/amp runs reova's postinstall hook.

Impact

Installation metadata and an organizational identifier may be disclosed to the configured collector.

Mechanism

The hook collects package, system, CI, and Git email-domain data, then posts it to the configured telemetry endpoint without an installer-facing consent step in the inspected path.

AI rationale

Evidence

package.json.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/package.json.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/index.js.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/tracker.js.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/collector.js.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/sender.js

Network endpoints1

telemetry.reo.dev/data

Decision evidence

public snapshot

AI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The root manifest enables Reova analytics and sets its endpoint to telemetry.reo.dev.
The installed reova dependency runs index.js from its postinstall hook, which starts tracking automatically.
Tracking proceeds when the dependent package is enabled and has a configured endpoint; the root package satisfies both conditions.
The collected install event includes package and system details, a CI flag, and the installer's Git email domain.
The sender makes an HTTP or HTTPS POST to the configured endpoint.
Agent configuration changes occur in the explicit setup CLI; the manifest has no install lifecycle hook.

Evidence against

The root package explicitly configures Reova analytics, and the inspected source identifies the event as install analytics; source inspection does not establish whether telemetry.reo.dev is a third-party or package-aligned recipient.
The setup command is a separately invoked binary, and its settings and plugin writes are not triggered by the package lifecycle.

Behavioral surface

Source

EnvironmentVars

Source & flagged code

8 flagged

dist/cli/setup.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst to = typeof rec.to === "string" ? rec.to : ""; return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to); } function mergepermissions(existing, to) { const merged = { ...existing }; const perms = (array.isarray(merged["amp.permissions"]) ? merged["amp.permissions"] : []).filter((e) => !isorydelegate(e)); perms.push(delegateentry(to)); merged["amp.permissions"] = perms; return merged; } function removepermissions(existing) { const merged = { ...existing };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

package.jsonView file

50"reova": { "enabled": true, "endpoint": "https://telemetry.reo.dev/data" }, "main": "dist/index.js", "types": "dist/index.d.ts", "exports": { ".": { "types": "./dist/index.d.ts", "default": "./dist/index.js" } }, "bin": { "ory-amp": "dist/cli/main.js", "ory-amp-permission": "dist/permission.js",

Medium

Ai Review Evidence

The root manifest enables Reova analytics and sets its endpoint to telemetry.reo.dev.

package.jsonView on unpkg · L50

.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/package.jsonView file

1{ "name": "reova", "version": "0.7.0", "description": "Opt-in npm install analytics: sends install metrics to an endpoint you configure.", "main": "lib.js", "scripts": { "postinstall": "node index.js", "test": "node test-l

Medium

Suspicious Lifecycle Evidence

The installed reova dependency runs index.js from its postinstall hook, which starts tracking automatically.

.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/package.jsonView on unpkg · L1

.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/index.jsView file

8const Tracker = require('./src/tracker'); const START_DELAY_MS = 500; // let sibling packages finish extracting const MAX_WAIT_TIME = 15000; // hard cap before exit function delay(ms) { return new Promise((resolve) => setTimeout(resolve, ms)); } const trackingPromise = delay(START_DELAY_MS) .then(() =>

Medium

Suspicious Lifecycle Evidence

The installed reova dependency runs index.js from its postinstall hook, which starts tracking automatically.

.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/index.jsView on unpkg · L8

.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/tracker.jsView file

49async trackDependent(dependent) { const pkg = dependent.packageJson; const name = pkg?.name || 'unknown'; if (!this.config.isEnabled(pkg)) { if (this.config.isVerbose()) { console.log(`[reova] ${name}: not opted in (reova.enabled !== true) — skipped`); } return { package: name, success: false, reason: 'not-opted-in' }; } const endpoint = this.config.getEndpoint(pkg); if (!endpoint) { if (this.config.isVerbose()) { console.log(`[reova] ${name}: no valid end

Medium

Ai Review Evidence

Tracking proceeds when the dependent package is enabled and has a configured endpoint; the root package satisfies both conditions.

.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/tracker.jsView on unpkg · L49

.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/collector.jsView file

27collect(packageJson) { const name = packageJson?.name || 'unknown'; const version = packageJson?.version || 'unknown'; const emailDomain = this.getEmailDomain(); try { return { activity_type: 'npm_install', package: { name, version }, system: { platform: process.platform, // e.g. "darwin" arch: process.arch, // e.g. "arm64" nodeVersion: process.version, // e.g. "v20.11.0" osType: os.type(), osRelease: os.release(), cpuCount: os.cpus().length, },

Medium

Ai Review Evidence

The collected install event includes package and system details, a CI flag, and the installer's Git email domain.

.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/collector.jsView on unpkg · L27

44installation: { timestamp: new Date().toISOString(), ci: this.isCI(), // boolean only — not which provider installId: crypto.randomUUID(), }, tracker: { name: 'reova', version: this.config ? this.config.getTrackerVersion() : 'unknown', }, // Organizational signal: email DOMAIN only (never the full address). ...(emailDomain ? { metadata: {

Medium

Ai Review Evidence

The collected install event includes package and system details, a CI flag, and the installer's Git email domain.

.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/collector.jsView on unpkg · L44

.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/sender.jsView file

63makeRequest(payload, endpoint, detached = false) { return new Promise((resolve, reject) => { const url = new URL(endpoint); const isHttps = url.protocol === 'https:'; const client = isHttps ? https : http; const options = { hostname: url.hostname, port: url.port || (isHttps ? 443 : 80), path: url.pathname + url.search, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload), 'User-Agent': `reov

Medium

Ai Review Evidence

The sender makes an HTTP or HTTPS POST to the configured endpoint.

.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/sender.jsView on unpkg · L63

Source & flagged code

8 flagged · loading source

dist/cli/setup.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

package.jsonView file

Medium

Findings

1 High8 Medium3 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js

MediumEnvironment Vars

MediumAi Review Evidencepackage.json

MediumSuspicious Lifecycle Evidence.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/package.json

MediumSuspicious Lifecycle Evidence.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/index.js

MediumAi Review Evidence.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/tracker.js

MediumAi Review Evidence.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/collector.js

MediumAi Review Evidence.lpm-dependency-evidence-4fea6c62-b09a-45f0-a775-b091221c435e/1/npm-linux/src/sender.js

Affected versions and remediation

This report applies to @ory/amp@1.5.1.

See all versions of @ory/amp for other recorded verdicts.

Review the evidence and your use of @ory/amp@1.5.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 17:12:03.048Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.