registry / Data exfiltration / @ory/mastra
@ory/mastra
Ory Agent Security for Mastra — per-tool authorization, activity auditing, and identity propagation via agent tool-call hooks (or wrapping tool execute). Built on @ory/argus.
This report shows the evidence for @ory/mastra@1.8.0. 2 of 23 known versions are blocked or flagged. The newest version, 1.8.1, is allowed. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe transitive reova postinstall hook automatically sends the Git email domain read from ~/.gitconfig to telemetry.reo.dev. This is install-time transmission of Git details without installer consent, so the package is malicious under the install-time contact rule.
Static reason
No blocking static signals were detected.
Trigger
Installing @ory/mastra runs reova's postinstall hook; tracking is enabled by this package's manifest.
Impact
The install discloses Git configuration details that can identify the user's organization without installer consent.
Mechanism
The hook reads ~/.gitconfig, extracts the domain from the configured Git user email, adds it to event metadata, and POSTs the event to the configured endpoint.
Attack narrative
On installation, reova's postinstall hook starts tracking. Because @ory/mastra enables tracking and configures an endpoint, the hook reads the Git user email from ~/.gitconfig, extracts its domain, and sends it with install metrics to telemetry.reo.dev. The installer is not prompted to consent to this collection and transmission of Git configuration details.
AI rationale
The transitive reova postinstall hook automatically sends the Git email domain read from ~/.gitconfig to telemetry.reo.dev. This is install-time transmission of Git details without installer consent, so the package is malicious under the install-time contact rule.
Evidence
package.json.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/package.json.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/index.js.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/src/collector.js.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/src/tracker.js.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/src/sender.js~/.gitconfig
Network endpoints1
/data
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package enables reova install analytics and sets its endpoint to https://telemetry.reo.dev/data.
- The reova dependency declares a postinstall script that runs node index.js; that entry point automatically starts tracking.
- The install collector reads the Git user email from ~/.gitconfig, extracts its domain, and includes that domain in the event metadata.
- The tracker collects and sends the event when enabled and an endpoint is configured; the package supplies both settings.
- The event also includes ordinary install metrics such as package version, platform, runtime version, CI status, and a random install ID.
Evidence against
- The collector sends only the Git email domain, not the full email address.
- The dependency supports global opt-out settings, but the package config enables tracking by default.
Behavioral surface
Source & flagged code
7 flaggedpackage.jsonView file
11"reova": {
"enabled": true,
"endpoint": "https://telemetry.reo.dev/data"
},
High
Ai Review Evidence
The package enables reova install analytics and sets its endpoint to https://telemetry.reo.dev/data.
package.jsonView on unpkg · L11.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/package.jsonView file
5"main": "lib.js",
"scripts": {
"postinstall": "node index.js",
"test": "node test-local-install.js
High
Suspicious Lifecycle Evidence
The reova dependency declares a postinstall script that runs node index.js; that entry point automatically starts tracking.
.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/package.jsonView on unpkg · L5Findings
7 High1 Low
HighAi Review Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/package.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/src/tracker.js
HighAi Review Evidence.lpm-dependency-evidence-3ab7c6ae-e308-4968-af78-d9342a5d0f97/1/npm-linux/src/sender.js
LowScripts Present
Affected versions and remediation
This report applies to @ory/mastra@1.8.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @ory/mastra@1.8.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.