@ory/amp@1.5.3
Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing
AI Security Review
scanned 4h ago · by lpm-firewall-ai@ory/amp configures an enabled telemetry dependency with a fixed recipient, and the dependency runs its tracker from postinstall. The automatic collection and transmission of installation and host metadata supports blocking this release.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing @ory/amp with dependency lifecycle scripts enabled.
Impact
Installation identifiers and environment details are disclosed to the configured telemetry recipient without installer consent established in the inspected source.
Mechanism
reova postinstall runs a tracker that collects package and system details and posts the payload to telemetry.reo.dev.
Attack narrative
During installation, the reova dependency’s postinstall starts tracking. @ory/amp configures telemetry.reo.dev and enables tracking. The tracker collects package and host details, including system attributes and installation metadata, then posts them to that endpoint. The inspected source does not establish installer consent for this automatic disclosure.
AI rationale
@ory/amp configures an enabled telemetry dependency with a fixed recipient, and the dependency runs its tracker from postinstall. The automatic collection and transmission of installation and host metadata supports blocking this release.
Evidence
package.json.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/package.json.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/index.js.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/tracker.js.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/collector.js.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/sender.js~/.gitconfig
Network endpoints1
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package depends on reova, whose manifest runs node index.js during postinstall; that entrypoint starts tracking automatically.
- The parent package enables reova and configures telemetry.reo.dev as the endpoint, without installer consent being established in the inspected source.
- The tracker sends for dependent packages when enabled and an endpoint is configured.
- The install payload includes package and version, platform, architecture, Node version, OS type and release, CPU count, timestamp, CI status, and a random install identifier.
- The sender makes an HTTP request and writes the collected payload to it.
Evidence against
Behavioral surface
EnvironmentVarsFilesystem
UrlStrings
Source & flagged code
8 flagged · loading sourcedist/cli/setup.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
nst to = typeof rec.to === "string" ? rec.to : "";
return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to);
}
function mergepermissions(existing, to) {
const merged = { ...existing };
const perms = (array.isarray(merged["amp.permissions"])
? merged["amp.permissions"]
: []).filter((e) => !isorydelegate(e));
perms.push(delegateentry(to));
merged["amp.permissions"] = perms;
return merged;
}
function removepermissions(existing) {
const merged = { ...existing };
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/setup.jsView on unpkgdist/cli/main.jsView file
•matchType = normalized_sha256
matchedPackage = @ory/amp@1.5.2
matchedPath = dist/cli/main.js
matchedIdentity = npm:QG9yeS9hbXA:1.5.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Findings
8 High1 Medium3 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js
HighKnown Malware Source Similaritydist/cli/main.js
HighKnown Malware Source Fingerprint Signaturedist/cli/main.js
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/package.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/index.js
HighAi Review Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/tracker.js
HighAi Review Evidence.lpm-dependency-evidence-861cd6a8-d6b9-4487-9466-7f71f6b7fc50/1/npm-linux/src/collector.js
MediumEnvironment Vars
Affected versions and remediation
This report applies to @ory/amp@1.5.3.
See all versions of @ory/amp for other recorded verdicts.
- Avoid installing @ory/amp@1.5.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.