@ory/cline@1.8.1
Ory plugin for Cline: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package enables an install-time telemetry hook that reads Git configuration and sends the extracted email domain to an external endpoint. This is unsolicited transmission of Git-derived user information.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing @ory/cline installs reova, whose postinstall hook runs automatically.
Impact
The collector discloses Git-derived organizational information to an external endpoint without the installer's consent.
Mechanism
The package enables reova and sets its endpoint; the hook reads the Git email from ~/.gitconfig, extracts its domain, and POSTs the collected payload.
Attack narrative
On installation, reova's postinstall hook starts analytics because @ory/cline sets reova.enabled to true and configures an endpoint. The tracker reads the Git email from ~/.gitconfig, includes its domain in the install payload, and sends that payload to telemetry.reo.dev. This exposes Git-derived organizational information without installer consent.
AI rationale
The package enables an install-time telemetry hook that reads Git configuration and sends the extracted email domain to an external endpoint. This is unsolicited transmission of Git-derived user information.
Evidence
package.json.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/index.js.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/tracker.js.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/collector.js.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/sender.js~/.gitconfig
Network endpoints1
telemetry.reo.dev/data
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest enables reova analytics and configures https://telemetry.reo.dev/data.
- The reova dependency runs its tracker from a postinstall hook.
- The tracker collects a payload and sends it to the configured endpoint when analytics is enabled.
- The payload includes the domain extracted from the installer's Git email configuration.
- The tracker reads that email from ~/.gitconfig.
- The sender transmits the payload in an HTTP POST.
Evidence against
Behavioral surface
EnvironmentVarsFilesystem
Source & flagged code
8 flaggeddist/cli/main.jsView file
•matchType = malicious_source_fingerprint_signature
signature = 6962edcbe49e448b
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @ory/cline@1.7.0
matchedPath = dist/cli/main.js
matchedIdentity = npm:QG9yeS9jbGluZQ:1.7.0
similarity = 1.000
shingleOverlap = 7
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/cli/main.jsView on unpkgpackage.jsonView file
49"reova": {
"enabled": true,
"endpoint": "https://telemetry.reo.dev/data"
},
"main": "dist/index.js",
"types": "dist/index.d.
High
Ai Review Evidence
The manifest enables reova analytics and configures https://telemetry.reo.dev/data.
package.jsonView on unpkg · L49.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/index.jsView file
17const trackingPromise = delay(START_DELAY_MS)
.then(() => new Tracker().track())
.catch(() => {
// Never surface errors to the install.
});
Promise.race([trackingPromise, delay(MAX_WAIT_TIME)]).finally(() => {
process.exit(0);
});
High
Suspicious Lifecycle Evidence
The reova dependency runs its tracker from a postinstall hook.
.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/index.jsView on unpkg · L17.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/tracker.jsView file
53if (!this.config.isEnabled(pkg)) {
if (this.config.isVerbose()) {
console.log(`[reova] ${name}: not opted in (reova.enabled !== true) — skipped`);
}
return { package: name, success: false, reason: 'not-opted-in' };
}
const endpoint = this.config.getEndpoint(pkg);
if (!endpoint) {
if (this.config.isVerbose()) {
console.log(`[reova] ${name}: no valid endpoint configured — skipped`);
}
return { package: name, success
High
Ai Review Evidence
The tracker collects a payload and sends it to the configured endpoint when analytics is enabled.
.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/tracker.jsView on unpkg · L5368const data = this.collector.collect(pkg);
if (this.config.isVerbose()) {
console.log(`[reova] ${name}: collected`, JSON.stringify(data));
}
const result = await this.sender.send(data, endpoint);
return { package:
High
Ai Review Evidence
The tracker collects a payload and sends it to the configured endpoint when analytics is enabled.
.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/tracker.jsView on unpkg · L68.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/collector.jsView file
27collect(packageJson) {
const name = packageJson?.name || 'unknown';
const version = packageJson?.version || 'unknown';
const emailDomain = this.getEmailDomain();
try {
return {
activity_type: 'npm_install',
package: { name, version },
system: {
platform: process.platform, // e.g. "darwin"
arch: process.arch, // e.g. "arm64"
nodeVersion: process.version, // e.g. "v20.11.0"
osType: os.type(),
osRelease: os.release(),
cp
High
Ai Review Evidence
The payload includes the domain extracted from the installer's Git email configuration.
.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/collector.jsView on unpkg · L2771getEmailDomain() {
try {
const email = this.readGitEmail();
if (!email) return null;
const at = email.lastIndexOf('@');
if (at === -1) return null;
const domain = email.slice(at + 1).trim().toLowerCase();
return domain || null;
} catch (e) {
return null;
}
}
/** Extract the git user email from ~/.gitconfig. Full email is never sent. */
readGitEmail() {
const gitConfigPat
High
Ai Review Evidence
The tracker reads that email from ~/.gitconfig.
.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/collector.jsView on unpkg · L71.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/sender.jsView file
63makeRequest(payload, endpoint, detached = false) {
return new Promise((resolve, reject) => {
const url = new URL(endpoint);
const isHttps = url.protocol === 'https:';
const client = isHttps ? https : http;
const options = {
hostname: url.hostname,
port: url.port || (isHttps ? 443 : 80),
path: url.pathname + url.search,
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Content-Length': Buffer.byteLength(payload),
'User-Agent': `reova/${this.config ? this.config.getTrackerVersion()
High
Ai Review Evidence
The sender transmits the payload in an HTTP POST.
.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/sender.jsView on unpkg · L63Findings
8 High1 Medium2 Low
HighKnown Malware Source Fingerprint Signaturedist/cli/main.js
HighAi Review Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/tracker.js
HighAi Review Evidence.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/tracker.js
HighAi Review Evidence.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-44bb227a-0920-4f52-8732-22f7ef73fee5/1/npm-linux/src/sender.js
MediumEnvironment Vars
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @ory/cline@1.8.1.
See all versions of @ory/cline for other recorded verdicts.
- Avoid installing @ory/cline@1.8.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.