@ory/pi@1.8.0
Ory plugin for Pi (the minimal coding agent): scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package enables an install-time hook that sends the installer's Git email domain and installation metadata to telemetry.reo.dev without explicit installer consent. The Git email domain is identifying user or organizational data, making this install-time contact malicious under the review rules.
Static reason
No blocking static signals were detected.
Trigger
Installing @ory/pi runs the reova dependency's postinstall hook; telemetry is enabled by default unless globally opted out.
Impact
The endpoint receives identifying organizational information about the installer and details about the installation without the installer's explicit consent.
Mechanism
The hook discovers the dependent package configuration, reads ~/.gitconfig, collects install and machine details plus the email domain, then POSTs the event to the configured endpoint.
Attack narrative
During installation, reova's postinstall automatically sends telemetry to telemetry.reo.dev because this package enables telemetry and configures that endpoint. The event includes package and machine metadata plus the domain from the installer's Git email, read from ~/.gitconfig. The installer has no explicit consent prompt; a global opt-out is available.
AI rationale
The package enables an install-time hook that sends the installer's Git email domain and installation metadata to telemetry.reo.dev without explicit installer consent. The Git email domain is identifying user or organizational data, making this install-time contact malicious under the review rules.
Evidence
package.json.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/package.json.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/index.js.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/src/tracker.js.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/src/collector.js.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/src/sender.js~/.gitconfig (read)
Network endpoints
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package config enables reova install telemetry and sets https://telemetry.reo.dev/data as its endpoint.
- reova declares a postinstall script that runs index.js, which automatically calls Tracker.track().
- The tracker collects and sends an event when telemetry is enabled and an endpoint is configured; this package meets both conditions.
- The collector reads the Git email from ~/.gitconfig and includes its domain in the event alongside install and machine metadata.
- The sender sends the event as an HTTP POST to the configured endpoint.
Evidence against
- The collector sends the Git email domain, not the full email address or Git user name.
- The payload also contains ordinary install and machine metadata such as package version, platform, Node version, OS release, CPU count, and a random install ID.
- The dependency supports global telemetry opt-outs, but telemetry is enabled by default for this package.
Behavioral surface
CryptoFilesystem
Source & flagged code
8 flaggedpackage.jsonView file
51"reova": {
"enabled": true,
"endpoint": "https://telemetry.reo.dev/data"
},
"main": "dist/index.js",
"types": "dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
}
},
"bin": {
"ory-pi": "dist/cli/main.js",
"ory-pi-setup": "dist/cli/setup.js"
},
"pi": {
"ex
High
Ai Review Evidence
The package config enables reova install telemetry and sets https://telemetry.reo.dev/data as its endpoint.
package.jsonView on unpkg · L51.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/package.jsonView file
1{
"name": "reova",
"version": "0.7.0",
"description": "Opt-in npm install analytics: sends install metrics to an endpoint you configure.",
"main": "lib.js",
"scripts": {
"postinstall": "node index.js",
High
Suspicious Lifecycle Evidence
reova declares a postinstall script that runs index.js, which automatically calls Tracker.track().
.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/package.jsonFindings
8 High3 Low
HighAi Review Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/package.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/src/tracker.js
HighAi Review Evidence.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/src/tracker.js
HighAi Review Evidence.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-2a68fffa-9526-46c2-ad35-1ef48339a254/1/npm-linux/src/sender.js
Affected versions and remediation
This report applies to @ory/pi@1.8.0.
See all versions of @ory/pi for other recorded verdicts.
- Avoid installing @ory/pi@1.8.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.