registry / Data exfiltration / @ory/gemini-cli
@ory/gemini-cli
Ory extension for Gemini CLI: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call
This report shows the evidence for @ory/gemini-cli@1.8.0. 1 of 23 known versions is blocked or flagged. The newest version, 1.8.1, is flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThis package enables an install-time telemetry hook that reads Git identity data and sends the email domain to a configured remote endpoint without installer consent. The concrete install-time transfer of Git configuration data meets the data-exfiltration rule.
Static reason
No blocking static signals were detected.
Trigger
Installation runs the reova dependency’s postinstall hook; this package configures reova as enabled with an endpoint.
Impact
The collector receives an organizational identifier derived from the installer’s Git configuration.
Mechanism
The hook reads the Git email from ~/.gitconfig, extracts its domain, adds it to an install event, and POSTs the event to the configured endpoint.
Attack narrative
During installation, the reova dependency’s postinstall hook runs automatically. Because this package enables reova and configures telemetry.reo.dev, the hook reads the installer’s Git email domain from ~/.gitconfig and sends it with install metadata to that endpoint without an installer consent prompt.
AI rationale
This package enables an install-time telemetry hook that reads Git identity data and sends the email domain to a configured remote endpoint without installer consent. The concrete install-time transfer of Git configuration data meets the data-exfiltration rule.
Evidence
package.json.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/index.js.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/collector.js.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/tracker.js.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/sender.js~/.gitconfig
Network endpoints1
telemetry.reo.dev/data
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package enables reova install analytics and configures https://telemetry.reo.dev/data.
- reova’s postinstall starts tracking automatically during dependency installation.
- The collector reads ~/.gitconfig and extracts the Git email domain.
- That email domain is included in the install event as metadata.
- The tracker sends the collected event to the configured endpoint with an HTTP POST.
Evidence against
- The package itself declares no lifecycle scripts; the install-time behavior comes from its reova dependency.
- The collector sends the email domain rather than the full email address and uses a random event ID.
Behavioral surface
ChildProcessFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/cli/main.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cli/main.js#virtual:normalized:round1View on unpkgpackage.jsonView file
51"enabled": true,
"endpoint": "https://telemetry.reo.dev/data"
},
"main": "dist/index.js",
"types": "dist/index.d.ts
High
Ai Review Evidence
The package enables reova install analytics and configures https://telemetry.reo.dev/data.
package.jsonView on unpkg · L51.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/index.jsView file
Findings
7 High4 Low
HighSemantic Analysis Limiteddist/cli/main.js#virtual:normalized:round1
HighAi Review Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/tracker.js
HighAi Review Evidence.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/sender.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @ory/gemini-cli@1.8.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @ory/gemini-cli@1.8.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.