registry / Malware / @ory/amp / 1.5.2

@ory/amp@1.5.2

Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing

AI Security Review

scanned 7h ago · by lpm-firewall-ai

The package's configured telemetry activates through a dependency postinstall and sends installer metadata to a publisher-selected endpoint without installer consent. This meets the policy for an automatic installation beacon.

Static reason

No blocking static signals were detected.

Trigger

Installing @ory/amp with lifecycle scripts enabled triggers reova's postinstall.

Impact

The installer's package and system metadata can be disclosed automatically to the telemetry recipient.

Mechanism

reova discovers dependent packages, collects install and system details for enabled packages, and posts the data to the configured endpoint.

Attack narrative

Installing @ory/amp pulls in reova, whose postinstall automatically runs a tracker. The package enables reova telemetry and sets its endpoint in package.json. The tracker collects package and system install details and posts them to that endpoint without an installer consent prompt.

AI rationale

Evidence

package.json.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/package.json.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/index.js.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/src/tracker.js.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/src/collector.js.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/src/sender.js

Network endpoints1

telemetry.reo.dev/data

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package depends on reova and enables its telemetry endpoint in package.json.
reova declares a postinstall script that runs index.js, which automatically starts its tracker.
The tracker processes enabled dependent packages and collects install data, including package and system details.
The tracker sends the collected data in an HTTP POST to the configured endpoint.

Evidence against

reova supports environment opt-outs, but the package's telemetry is enabled by default and the opt-outs require environment settings.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 37.0 KB of source, external domains: agents.console.ory.com

Source & flagged code

8 flagged

dist/cli/setup.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst to = typeof rec.to === "string" ? rec.to : ""; return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to); } function mergepermissions(existing, to) { const merged = { ...existing }; const perms = (array.isarray(merged["amp.permissions"]) ? merged["amp.permissions"] : []).filter((e) => !isorydelegate(e)); perms.push(delegateentry(to)); merged["amp.permissions"] = perms; return merged; } function removepermissions(existing) { const merged = { ...existing };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

package.jsonView file

Lines 27-88json

27 "oidc",

28 "session",

29 "mfa",

30 "sso",

31 "audit",

32 "audit-log",

33 "compliance",

34 "agent",

35 "ai-agent",

36 "agent-security",

37 "guardrails",

38 "llm",

39 "activity-auditing",

40 "observability",

41 "kratos",

42 "keto",

43 "hydra"

44 ],

45 "publishConfig": {

46 "access": "public",

47 "registry": "https://registry.npmjs.org/",

48 "provenance": true

49 },

50 "reova": {

51 "enabled": true,

52 "endpoint": "https://telemetry.reo.dev/data"

53 },

54 "main": "dist/index.js",

High

Ai Review Evidence

The package depends on reova and enables its telemetry endpoint in package.json.

package.jsonView on unpkg · L47

55 "types": "dist/index.d.ts",

56 "exports": {

57 ".": {

58 "types": "./dist/index.d.ts",

59 "default": "./dist/index.js"

60 }

61 },

62 "bin": {

63 "ory-amp": "dist/cli/main.js",

64 "ory-amp-permission": "dist/permission.js",

65 "ory-amp-setup": "dist/cli/setup.js"

66 },

67 "files": [

68 "dist",

69 "!dist/**/*.tsbuildinfo"

70 ],

71 "dependencies": {

72 "reova": "^0.7.0",

73 "@ory/argus": "1.5.2"

74 },

75 "devDependencies": {

76 "typescript": "^6.0.2"

High

Ai Review Evidence

The package depends on reova and enables its telemetry endpoint in package.json.

package.jsonView on unpkg · L68

77 },

78 "engines": {

79 "node": ">=22"

80 },

81 "scripts": {

82 "build": "tsc",

83 "clean": "rm -rf dist *.tsbuildinfo",

84 "test": "vitest run",

85 "test:watch": "vitest",

86 "typecheck": "tsc --noEmit"

87 }

88}

.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/package.jsonView file

5"main": "lib.js", "scripts": { "postinstall": "node index.js", "test": "node test-local-install.js" }, "keywords": [ "analytics", "install-analytics", "

High

Suspicious Lifecycle Evidence

reova declares a postinstall script that runs index.js, which automatically starts its tracker.

.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/package.jsonView on unpkg · L5

.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/index.jsView file

15} const trackingPromise = delay(START_DELAY_MS) .then(() => new Tracker().track()) .catch(() => { // Never surface errors to the install. }); Promise.race([trackingPromise, delay(MAX_WAIT_TIME)]).finally(() => {

High

Suspicious Lifecycle Evidence

reova declares a postinstall script that runs index.js, which automatically starts its tracker.

.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/index.jsView on unpkg · L15

.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/src/tracker.jsView file

50const pkg = dependent.packageJson; const name = pkg?.name || 'unknown'; if (!this.config.isEnabled(pkg)) { if (this.config.isVerbose()) { console.log(`[reova] ${name}: not opted in (reova.enabled !== true) — skipped`); } return { package: name, success: false, reason: 'not-opted-in' }; } const endpoint = this.config.getEndpoint(pkg); if (!endpoint) { if (this.config.isVerbose()) { console.log(`[reova] ${name}

High

Ai Review Evidence

The tracker processes enabled dependent packages and collects install data, including package and system details.

.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/src/tracker.jsView on unpkg · L50

.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/src/collector.jsView file

31try { return { activity_type: 'npm_install', package: { name, version }, system: { platform: process.platform, // e.g. "darwin" arch: process.arch, // e.g. "arm64" nodeVersion: process.version, // e.g. "v20.11.0" osType: os.type(), osRelease: os.release(), cpuCount: os.cpus().length, }, installation: {

High

Ai Review Evidence

The tracker processes enabled dependent packages and collects install data, including package and system details.

.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/src/collector.jsView on unpkg · L31

.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/src/sender.jsView file

66const isHttps = url.protocol === 'https:'; const client = isHttps ? https : http; const options = { hostname: url.hostname, port: url.port || (isHttps ? 443 : 80), path: url.pathname + url.search, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buf

High

Ai Review Evidence

The tracker sends the collected data in an HTTP POST to the configured endpoint.

.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/src/sender.jsView on unpkg · L66

Source & flagged code

8 flagged · loading source

dist/cli/setup.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/setup.jsView on unpkg

package.jsonView file

47"registry": "https://registry.npmjs.org/", "provenance": true }, "reova": { "enabled": true, "endpoint": "https://telemetry.reo.dev/data" }, "main

High

Ai Review Evidence

The package depends on reova and enables its telemetry endpoint in package.json.

Findings

8 High1 Medium3 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js

HighAi Review Evidencepackage.json

HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/package.json

HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/index.js

HighAi Review Evidence.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/src/tracker.js

HighAi Review Evidence.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/src/collector.js

HighAi Review Evidence.lpm-dependency-evidence-8addf319-b00d-4d0c-97ca-21dfee9015cb/1/npm-linux/src/sender.js

MediumEnvironment Vars

Affected versions and remediation

This report applies to @ory/amp@1.5.2.

See all versions of @ory/amp for other recorded verdicts.

Avoid installing @ory/amp@1.5.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 18:54:44.105Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages