@ory/pi@1.9.0
Ory plugin for Pi (the minimal coding agent): scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package adds an enabled install-time telemetry dependency that reads the installer's Git email domain and sends it to a configured endpoint. Because the install hook transmits Git identity data without a user request, this is malicious data exfiltration.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package runs the reova dependency's postinstall hook.
Impact
Discloses the installer's organization-identifying Git configuration data without a user request.
Mechanism
The hook reads ~/.gitconfig, extracts the Git email domain, adds it to an install event, and posts the payload to telemetry.reo.dev.
Attack narrative
On package installation, reova's postinstall hook runs automatically. This package opts into telemetry and supplies a fixed endpoint. The tracker reads ~/.gitconfig, extracts the email domain, includes it in an npm install event, and sends the event to telemetry.reo.dev. This exposes organization-identifying Git configuration during installation without a user request.
AI rationale
The package adds an enabled install-time telemetry dependency that reads the installer's Git email domain and sends it to a configured endpoint. Because the install hook transmits Git identity data without a user request, this is malicious data exfiltration.
Evidence
package.json.lpm-dependency-evidence-b087354c-5af7-405a-b0f5-67df7e2a2da1/1/npm-linux/package.json.lpm-dependency-evidence-b087354c-5af7-405a-b0f5-67df7e2a2da1/1/npm-linux/index.js.lpm-dependency-evidence-b087354c-5af7-405a-b0f5-67df7e2a2da1/1/npm-linux/src/collector.js.lpm-dependency-evidence-b087354c-5af7-405a-b0f5-67df7e2a2da1/1/npm-linux/src/tracker.js~/.gitconfig
Network endpoints1
telemetry.reo.dev/data
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest enables reova telemetry and configures https://telemetry.reo.dev/data.
- The reova dependency declares a postinstall script that runs node index.js.
- That install entry starts the tracker automatically.
- The collector reads the user's ~/.gitconfig to obtain the Git email domain.
- The email domain is added to the npm_install payload as metadata.
- The tracker sends the collected payload to the configured endpoint.
Evidence against
- The package's CLI and extension code otherwise matches its stated Ory Pi integration purpose.
- The collector sends the email domain rather than the full email address.
Behavioral surface
CryptoFilesystem
UrlStrings
Source & flagged code
8 flaggeddist/cli/main.jsView file
•matchType = normalized_sha256
matchedPackage = @ory/pi@1.8.1
matchedPath = dist/cli/main.js
matchedIdentity = npm:QG9yeS9waQ:1.8.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/main.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = 301d2fc5f6b67bef
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @ory/pi@1.8.1
matchedPath = dist/cli/main.js
matchedIdentity = npm:QG9yeS9waQ:1.8.1
similarity = 1.000
shingleOverlap = 6
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/cli/main.jsView on unpkgpackage.jsonView file
51"reova": {
"enabled": true,
"endpoint": "https://telemetry.reo.dev/data"
},
"main": "dist/index.js",
"types": "dist/index.d.ts",
"exports": {
".": {
"type
Findings
8 High3 Low
HighKnown Malware Source Similaritydist/cli/main.js
HighKnown Malware Source Fingerprint Signaturedist/cli/main.js
HighAi Review Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-b087354c-5af7-405a-b0f5-67df7e2a2da1/1/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-b087354c-5af7-405a-b0f5-67df7e2a2da1/1/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-b087354c-5af7-405a-b0f5-67df7e2a2da1/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-b087354c-5af7-405a-b0f5-67df7e2a2da1/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-b087354c-5af7-405a-b0f5-67df7e2a2da1/1/npm-linux/src/tracker.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @ory/pi@1.9.0.
See all versions of @ory/pi for other recorded verdicts.
- Avoid installing @ory/pi@1.9.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.