@ory/pi@1.8.1
Ory plugin for Pi (the minimal coding agent): scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package enables a dependency's install-time telemetry and directs it to telemetry.reo.dev. That hook reads the installer's Git email and sends the extracted email domain with installation metadata, meeting the install-time data exfiltration rule.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing @ory/pi runs the reova dependency's postinstall hook.
Impact
The external telemetry service learns an organizational identifier and installation metadata without the installer's explicit consent.
Mechanism
The hook scans for opted-in dependent packages, reads the Git email from ~/.gitconfig, extracts its domain, and POSTs it with package and system metadata to https://telemetry.reo.dev/data.
Attack narrative
Installing the package runs reova's postinstall tracker. Because this package enables reova and supplies an endpoint, the tracker reads the installer's Git email, extracts its domain, combines it with package and system details, and sends the event to telemetry.reo.dev. The email domain is identifying user or organization data sent automatically during installation without installer consent.
AI rationale
The package enables a dependency's install-time telemetry and directs it to telemetry.reo.dev. That hook reads the installer's Git email and sends the extracted email domain with installation metadata, meeting the install-time data exfiltration rule.
Evidence
package.json.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/package.json.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/index.js.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/src/collector.js.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/src/sender.js~/.gitconfig
Network endpoints1
telemetry.reo.dev/data
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package enables `reova` telemetry and configures `https://telemetry.reo.dev/data`.
- Its `reova` dependency has a `postinstall` script that runs the tracker automatically during installation.
- The tracker reads the installer's Git email from `~/.gitconfig`.
- The install event includes the Git email domain along with package and system metadata.
- The tracker sends the collected event in an HTTP POST to the configured endpoint.
Evidence against
- The payload contains only the email domain, not the full email address.
- The package describes itself as an Ory Pi integration, and the reported CLI behavior is consistent with its documented commands.
Behavioral surface
CryptoFilesystem
UrlStrings
Source & flagged code
8 flaggeddist/cli/main.jsView file
•matchType = normalized_sha256
matchedPackage = @ory/pi@1.8.0
matchedPath = dist/cli/main.js
matchedIdentity = npm:QG9yeS9waQ:1.8.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/main.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = 301d2fc5f6b67bef
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @ory/pi@1.8.0
matchedPath = dist/cli/main.js
matchedIdentity = npm:QG9yeS9waQ:1.8.0
similarity = 1.000
shingleOverlap = 6
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/cli/main.jsView on unpkgpackage.jsonView file
51"reova": {
"enabled": true,
"endpoint": "https://telemetry.reo.dev/data"
},
"main": "dist/index.js",
"types": "dist/index.d.ts",
"exports": {
".": {
High
Ai Review Evidence
The package enables `reova` telemetry and configures `https://telemetry.reo.dev/data`.
package.jsonView on unpkg · L51.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/package.jsonView file
6"scripts": {
"postinstall": "node index.js",
"test": "node test-local-install.js"
},
"keywords": [
High
Suspicious Lifecycle Evidence
Its `reova` dependency has a `postinstall` script that runs the tracker automatically during installation.
.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/package.jsonView on unpkg · L6.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/index.jsView file
17const trackingPromise = delay(START_DELAY_MS)
.then(() => new Tracker().track())
.catch(() => {
// Never surface errors to the install.
});
Promise.race([track
High
Suspicious Lifecycle Evidence
Its `reova` dependency has a `postinstall` script that runs the tracker automatically during installation.
.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/index.jsView on unpkg · L17.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/src/collector.jsView file
84/** Extract the git user email from ~/.gitconfig. Full email is never sent. */
readGitEmail() {
const gitConfigPath = path.join(os.homedir(), '.gitconfig');
if (!fs.existsSync(gitConfigPath)) return
High
Ai Review Evidence
The tracker reads the installer's Git email from `~/.gitconfig`.
.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/src/collector.jsView on unpkg · L8453// Organizational signal: email DOMAIN only (never the full address).
...(emailDomain ? { metadata: { emailDomain } } : {}),
};
High
Ai Review Evidence
The install event includes the Git email domain along with package and system metadata.
.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/src/collector.jsView on unpkg · L53.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/src/sender.jsView file
72path: url.pathname + url.search,
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Content-Length': Buffer.byteLength(payload),
'User-Agent':
High
Ai Review Evidence
The tracker sends the collected event in an HTTP POST to the configured endpoint.
.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/src/sender.jsView on unpkg · L72Findings
8 High3 Low
HighKnown Malware Source Similaritydist/cli/main.js
HighKnown Malware Source Fingerprint Signaturedist/cli/main.js
HighAi Review Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/package.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-9848bd65-8d72-4c8e-afa1-30d6b41f58ba/1/npm-linux/src/sender.js
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @ory/pi@1.8.1.
See all versions of @ory/pi for other recorded verdicts.
- Avoid installing @ory/pi@1.8.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.