registry / Data exfiltration / @ory/openclaw
@ory/openclaw
Ory plugin for OpenClaw: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call
This report shows the evidence for @ory/openclaw@1.8.0. 1 of 24 known versions is blocked or flagged. The newest version, 1.9.0, is flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe transitive reova dependency runs automatically on install and sends telemetry that includes the Git email domain read from ~/.gitconfig to a fixed endpoint. This unconsented transfer of Git account information makes the package malicious.
Static reason
No blocking static signals were detected.
Trigger
Installing the package triggers reova's postinstall tracker.
Impact
The install discloses Git account organization information without the installer's consent.
Mechanism
The tracker finds this package's enabled reova configuration, reads the Git email from ~/.gitconfig, adds its domain to the telemetry payload, and POSTs the payload to the configured endpoint.
Attack narrative
Installing the package runs reova's postinstall hook, which starts its tracker. The package has telemetry enabled and supplies a fixed endpoint. The tracker reads the Git email configured in ~/.gitconfig, places its domain in the install telemetry payload, and sends the payload to telemetry.reo.dev without the installer's consent.
AI rationale
The transitive reova dependency runs automatically on install and sends telemetry that includes the Git email domain read from ~/.gitconfig to a fixed endpoint. This unconsented transfer of Git account information makes the package malicious.
Evidence
package.json.lpm-dependency-evidence-bd138eef-cce4-40b7-ae02-0e996cab5712/1/npm-linux/package.json.lpm-dependency-evidence-bd138eef-cce4-40b7-ae02-0e996cab5712/1/npm-linux/index.js.lpm-dependency-evidence-bd138eef-cce4-40b7-ae02-0e996cab5712/1/npm-linux/src/collector.js.lpm-dependency-evidence-bd138eef-cce4-40b7-ae02-0e996cab5712/1/npm-linux/src/tracker.js.lpm-dependency-evidence-bd138eef-cce4-40b7-ae02-0e996cab5712/1/npm-linux/src/sender.js~/.gitconfig
Network endpoints1
telemetry.reo.dev/data
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package enables reova telemetry and configures https://telemetry.reo.dev/data.
- The reova dependency runs a postinstall script that starts its tracker automatically.
- The tracker collects telemetry for enabled packages and sends it to the configured endpoint.
- The collector reads the Git email from ~/.gitconfig and includes its domain in the payload.
- The sender transmits the payload using an HTTP POST.
Evidence against
- The collector sends only the Git email domain, not the full address.
- The payload also contains package, runtime, platform, and anonymous install ID fields.
Behavioral surface
Filesystem
UrlStrings
Source & flagged code
8 flaggeddist/cli/plugin-config.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cli/plugin-config.js#virtual:normalized:round1View on unpkgpackage.jsonView file
47"reova": {
"enabled": true,
"endpoint": "https://telemetry.reo.dev/data"
},
"main": "dist/index.
High
Ai Review Evidence
The package enables reova telemetry and configures https://telemetry.reo.dev/data.
package.jsonView on unpkg · L47.lpm-dependency-evidence-bd138eef-cce4-40b7-ae02-0e996cab5712/1/npm-linux/package.jsonView file
Findings
8 High3 Low
HighSemantic Analysis Limiteddist/cli/plugin-config.js#virtual:normalized:round1
HighAi Review Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-bd138eef-cce4-40b7-ae02-0e996cab5712/1/npm-linux/package.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-bd138eef-cce4-40b7-ae02-0e996cab5712/1/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-bd138eef-cce4-40b7-ae02-0e996cab5712/1/npm-linux/src/tracker.js
HighAi Review Evidence.lpm-dependency-evidence-bd138eef-cce4-40b7-ae02-0e996cab5712/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-bd138eef-cce4-40b7-ae02-0e996cab5712/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-bd138eef-cce4-40b7-ae02-0e996cab5712/1/npm-linux/src/sender.js
Affected versions and remediation
This report applies to @ory/openclaw@1.8.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @ory/openclaw@1.8.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.