@ory/gemini-cli@1.8.1
Ory extension for Gemini CLI: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package opts into reova install telemetry and configures an endpoint, so the dependency's postinstall automatically sends install data that includes a Git email domain. The source does not show credential theft or full email collection, so this is suspicious install-time telemetry rather than a clear malicious attack.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package causes the reova dependency's postinstall hook to run.
Impact
The publisher receives identifying organizational metadata and install telemetry without a separate user opt-in at install time.
Mechanism
reova discovers this package's enabled configuration, reads the Git email domain from ~/.gitconfig, collects install and system details, and POSTs them to the configured endpoint.
AI rationale
The package opts into reova install telemetry and configures an endpoint, so the dependency's postinstall automatically sends install data that includes a Git email domain. The source does not show credential theft or full email collection, so this is suspicious install-time telemetry rather than a clear malicious attack.
Evidence
package.json.lpm-dependency-evidence-5582106e-019f-4f89-b044-9063b9044621/1/npm-linux/package.json.lpm-dependency-evidence-5582106e-019f-4f89-b044-9063b9044621/1/npm-linux/index.js.lpm-dependency-evidence-5582106e-019f-4f89-b044-9063b9044621/1/npm-linux/src/tracker.js.lpm-dependency-evidence-5582106e-019f-4f89-b044-9063b9044621/1/npm-linux/src/collector.js~/.gitconfig
Network endpoints1
telemetry.reo.dev
Decision evidence
public snapshotAI called this Suspicious at 97.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package enables reova telemetry and configures https://telemetry.reo.dev/data in package.json.
- The reova dependency runs node index.js from its postinstall hook, which starts its tracker automatically.
- The tracker collects and sends an install event when the dependent package is enabled and has an endpoint.
- The event includes the Git email domain, read from ~/.gitconfig, along with package and system information.
Evidence against
- The collected Git identity is limited to the email domain; the source says it does not send the full email, Git user name, paths, dependency list, or environment variables.
- The event includes ordinary package, platform, runtime, OS, CPU-count, CI-boolean, timestamp, and random install-ID fields.
Behavioral surface
ChildProcessFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli/main.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cli/main.js#virtual:normalized:round1View on unpkgdist/cli/assets.jsView file
•matchType = normalized_sha256
matchedPackage = @ory/gemini-cli@1.8.0
matchedPath = dist/cli/assets.js
matchedIdentity = npm:QG9yeS9nZW1pbmktY2xp:1.8.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/assets.jsView on unpkgdist/cli/main.jsView file
Findings
3 High5 Medium4 Low
HighSemantic Analysis Limiteddist/cli/main.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/cli/assets.js
HighKnown Malware Source Fingerprint Signaturedist/cli/main.js
MediumAi Review Evidencepackage.json
MediumSuspicious Lifecycle Evidence.lpm-dependency-evidence-5582106e-019f-4f89-b044-9063b9044621/1/npm-linux/package.json
MediumSuspicious Lifecycle Evidence.lpm-dependency-evidence-5582106e-019f-4f89-b044-9063b9044621/1/npm-linux/index.js
MediumAi Review Evidence.lpm-dependency-evidence-5582106e-019f-4f89-b044-9063b9044621/1/npm-linux/src/tracker.js
MediumAi Review Evidence.lpm-dependency-evidence-5582106e-019f-4f89-b044-9063b9044621/1/npm-linux/src/collector.js
LowScripts Present
Low
Affected versions and remediation
This report applies to @ory/gemini-cli@1.8.1.
See all versions of @ory/gemini-cli for other recorded verdicts.
- Review the evidence and your use of @ory/gemini-cli@1.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.