@ory/gemini-cli@1.8.0
Ory extension for Gemini CLI: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call
AI Security Review
scanned 3d ago · by lpm-firewall-aiThis package enables an install-time telemetry hook that reads Git identity data and sends the email domain to a configured remote endpoint without installer consent. The concrete install-time transfer of Git configuration data meets the data-exfiltration rule.
Static reason
No blocking static signals were detected.
Trigger
Installation runs the reova dependency’s postinstall hook; this package configures reova as enabled with an endpoint.
Impact
The collector receives an organizational identifier derived from the installer’s Git configuration.
Mechanism
The hook reads the Git email from ~/.gitconfig, extracts its domain, adds it to an install event, and POSTs the event to the configured endpoint.
Attack narrative
During installation, the reova dependency’s postinstall hook runs automatically. Because this package enables reova and configures telemetry.reo.dev, the hook reads the installer’s Git email domain from ~/.gitconfig and sends it with install metadata to that endpoint without an installer consent prompt.
AI rationale
This package enables an install-time telemetry hook that reads Git identity data and sends the email domain to a configured remote endpoint without installer consent. The concrete install-time transfer of Git configuration data meets the data-exfiltration rule.
Evidence
package.json.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/index.js.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/collector.js.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/tracker.js.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/sender.js~/.gitconfig
Network endpoints1
telemetry.reo.dev/data
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package enables reova install analytics and configures https://telemetry.reo.dev/data.
- reova’s postinstall starts tracking automatically during dependency installation.
- The collector reads ~/.gitconfig and extracts the Git email domain.
- That email domain is included in the install event as metadata.
- The tracker sends the collected event to the configured endpoint with an HTTP POST.
Evidence against
- The package itself declares no lifecycle scripts; the install-time behavior comes from its reova dependency.
- The collector sends the email domain rather than the full email address and uses a random event ID.
Behavioral surface
ChildProcessFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/cli/main.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cli/main.js#virtual:normalized:round1View on unpkgpackage.jsonView file
51"enabled": true,
"endpoint": "https://telemetry.reo.dev/data"
},
"main": "dist/index.js",
"types": "dist/index.d.ts
High
Ai Review Evidence
The package enables reova install analytics and configures https://telemetry.reo.dev/data.
package.jsonView on unpkg · L51.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/index.jsView file
14);
}
const trackingPromise = delay(START_DELAY_MS)
.then(() => new Tracker().track())
.catch(() => {
// Never surface errors to the install.
});
Promise.race(
High
Suspicious Lifecycle Evidence
reova’s postinstall starts tracking automatically during dependency installation.
.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/index.jsView on unpkg · L14.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/collector.jsView file
85itEmail() {
const gitConfigPath = path.join(os.homedir(), '.gitconfig');
if (!fs.existsSync(gitConfigPath)) return null;
const content = fs.readFileSync(gitConfigPath, 'utf8');
let inUserSection = false;
for (const line of content.split('\n')) {
const trimmed = line.trim();
High
Ai Review Evidence
The collector reads ~/.gitconfig and extracts the Git email domain.
.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/collector.jsView on unpkg · L8553// Organizational signal: email DOMAIN only (never the full address).
...(emailDomain ? { metadata: { emailDomain } } : {}),
High
Ai Review Evidence
That email domain is included in the install event as metadata.
.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/collector.jsView on unpkg · L53.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/tracker.jsView file
60const endpoint = this.config.getEndpoint(pkg);
if (!endpoint) {
if (this.config.isVerbose()) {
console.log(`[reova] ${name}: no valid endpoint configured — skipped`);
}
return { package: name, success: false, reason: 'no-endpoint' };
}
const data = this.c
High
Ai Review Evidence
The tracker sends the collected event to the configured endpoint with an HTTP POST.
.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/tracker.jsView on unpkg · L60.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/sender.jsView file
69const options = {
hostname: url.hostname,
port: url.port || (isHttps ? 443 : 80),
path: url.pathname + url.search,
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Content-Length': Buffer.byteLength(payload),
High
Ai Review Evidence
The tracker sends the collected event to the configured endpoint with an HTTP POST.
.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/sender.jsView on unpkg · L69Findings
7 High4 Low
HighSemantic Analysis Limiteddist/cli/main.js#virtual:normalized:round1
HighAi Review Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/tracker.js
HighAi Review Evidence.lpm-dependency-evidence-efefd78d-bddc-41ac-93b8-8a4a305e3577/1/npm-linux/src/sender.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ory/gemini-cli@1.8.0.
See all versions of @ory/gemini-cli for other recorded verdicts.
- Avoid installing @ory/gemini-cli@1.8.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.