@ory/openclaw@1.9.0
Ory plugin for OpenClaw: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call
AI Security Review
scanned 2d ago · by lpm-firewall-aiThis package enables install telemetry to `telemetry.reo.dev`, and the dependency's postinstall hook can include the installer's git email domain. The inspected payload does not include the full address or credentials, so this is suspicious telemetry rather than a malicious exfiltration finding.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing this package runs the `reova` dependency's postinstall hook.
Impact
The telemetry exposes organizational identity information without explicit installer consent; no credential theft or broader data collection was identified.
Mechanism
The hook collects install and runtime details, optionally reads the email domain from `~/.gitconfig`, and sends the event to the endpoint configured in this package.
AI rationale
This package enables install telemetry to `telemetry.reo.dev`, and the dependency's postinstall hook can include the installer's git email domain. The inspected payload does not include the full address or credentials, so this is suspicious telemetry rather than a malicious exfiltration finding.
Evidence
package.json.lpm-dependency-evidence-8d17b68a-eeba-461a-98d7-88ddaf0fddf4/1/npm-linux/package.json.lpm-dependency-evidence-8d17b68a-eeba-461a-98d7-88ddaf0fddf4/1/npm-linux/index.js.lpm-dependency-evidence-8d17b68a-eeba-461a-98d7-88ddaf0fddf4/1/npm-linux/src/tracker.js.lpm-dependency-evidence-8d17b68a-eeba-461a-98d7-88ddaf0fddf4/1/npm-linux/src/collector.js~/.gitconfig
Network endpoints1
telemetry.reo.dev/data
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package enables `reova` and configures `https://telemetry.reo.dev/data`.
- The `reova` dependency declares a postinstall hook that runs `node index.js`.
- That hook starts the tracker, which collects and sends an install event to the configured endpoint.
- The event may include the email domain read from `~/.gitconfig`.
- The collector sends package and runtime details; the inspected source does not show it sending the full email address or environment-variable values.
Evidence against
- The event is limited to install analytics and an email domain, rather than a full email address or credentials.
- The package's own lifecycle scripts do not declare an install hook.
Behavioral surface
Filesystem
UrlStrings
Source & flagged code
8 flaggeddist/cli/plugin-config.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cli/plugin-config.js#virtual:normalized:round1View on unpkgdist/cli/main.jsView file
•matchType = normalized_sha256
matchedPackage = @ory/openclaw@1.8.0
matchedPath = dist/cli/main.js
matchedIdentity = npm:QG9yeS9vcGVuY2xhdw:1.8.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/main.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = cb39df1824699613
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @ory/openclaw@1.8.0
matchedPath = dist/cli/main.js
matchedIdentity = npm:QG9yeS9vcGVuY2xhdw:1.8.0
similarity = 1.000
shingleOverlap = 6
summary = package final verdict is malicious
Findings
3 High5 Medium3 Low
HighSemantic Analysis Limiteddist/cli/plugin-config.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/cli/main.js
HighKnown Malware Source Fingerprint Signaturedist/cli/main.js
MediumAi Review Evidencepackage.json
MediumSuspicious Lifecycle Evidence.lpm-dependency-evidence-8d17b68a-eeba-461a-98d7-88ddaf0fddf4/1/npm-linux/package.json
MediumAi Review Evidence.lpm-dependency-evidence-8d17b68a-eeba-461a-98d7-88ddaf0fddf4/1/npm-linux/index.js
MediumAi Review Evidence.lpm-dependency-evidence-8d17b68a-eeba-461a-98d7-88ddaf0fddf4/1/npm-linux/src/tracker.js
MediumAi Review Evidence.lpm-dependency-evidence-8d17b68a-eeba-461a-98d7-88ddaf0fddf4/1/npm-linux/src/collector.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @ory/openclaw@1.9.0.
See all versions of @ory/openclaw for other recorded verdicts.
- Review the evidence and your use of @ory/openclaw@1.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.