@ory/vercel-ai@1.8.0
Ory Agent Security for the Vercel AI SDK — per-tool authorization, activity auditing, and identity propagation by wrapping tool execute(). Built on @ory/argus.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThis package enables a dependency’s postinstall telemetry by default, and the payload includes the domain extracted from the local git email. That identifying detail makes this suspicious install-time telemetry, though the reviewed flow does not send the full email or credentials.
Static reason
No blocking static signals were detected.
Trigger
Installing this package with lifecycle scripts enabled triggers reova’s postinstall hook; telemetry is enabled in this package’s manifest.
Impact
The endpoint receives an organizational identifier without a separate user prompt. This is undisclosed install-time telemetry with identifying details.
Mechanism
reova reads ~/.gitconfig, extracts the email domain, adds it to the install payload, and POSTs the payload to telemetry.reo.dev.
AI rationale
This package enables a dependency’s postinstall telemetry by default, and the payload includes the domain extracted from the local git email. That identifying detail makes this suspicious install-time telemetry, though the reviewed flow does not send the full email or credentials.
Evidence
package.json.lpm-dependency-evidence-bedd7c06-33e6-41a4-8966-f3cd38c44e9e/1/npm-linux/package.json.lpm-dependency-evidence-bedd7c06-33e6-41a4-8966-f3cd38c44e9e/1/npm-linux/index.js.lpm-dependency-evidence-bedd7c06-33e6-41a4-8966-f3cd38c44e9e/1/npm-linux/src/collector.js.lpm-dependency-evidence-bedd7c06-33e6-41a4-8966-f3cd38c44e9e/1/npm-linux/src/sender.js~/.gitconfig
Network endpoints1
telemetry.reo.dev/data
Decision evidence
public snapshotAI called this Suspicious at 98.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package enables reova telemetry by default and configures https://telemetry.reo.dev/data.
- reova runs a postinstall hook that calls its tracker automatically.
- The tracker reads the git email domain and includes it in install metadata.
- The tracker sends the collected payload in an HTTP POST.
Evidence against
- The collected data includes package and system metadata, but not the full email address or environment variable values.
- The flagged Anthropic credential mention is in a deployment skill that says not to inspect or expose that credential.
Behavioral surface
Source & flagged code
6 flaggedpackage.jsonView file
11"reova": {
"enabled": true,
"endpoint": "https://telemetry.reo.dev/data"
},
"main": "dist/index.js",
"types": "dist/index.d.ts",
"exports": {
".": {
"type
Medium
Ai Review Evidence
The package enables reova telemetry by default and configures https://telemetry.reo.dev/data.
package.jsonView on unpkg · L11.lpm-dependency-evidence-bedd7c06-33e6-41a4-8966-f3cd38c44e9e/1/npm-linux/package.jsonView file
7"postinstall": "node index.js",
"test": "node test-local-install.js"
},
"keywords": [
"analytics",
"install-analytics",
"telemetry",
"npm",
"metrics",
Medium
Suspicious Lifecycle Evidence
reova runs a postinstall hook that calls its tracker automatically.
.lpm-dependency-evidence-bedd7c06-33e6-41a4-8966-f3cd38c44e9e/1/npm-linux/package.jsonView on unpkg · L7Findings
6 Medium1 Low
MediumAi Review Evidencepackage.json
MediumSuspicious Lifecycle Evidence.lpm-dependency-evidence-bedd7c06-33e6-41a4-8966-f3cd38c44e9e/1/npm-linux/package.json
MediumSuspicious Lifecycle Evidence.lpm-dependency-evidence-bedd7c06-33e6-41a4-8966-f3cd38c44e9e/1/npm-linux/index.js
MediumAi Review Evidence.lpm-dependency-evidence-bedd7c06-33e6-41a4-8966-f3cd38c44e9e/1/npm-linux/src/collector.js
MediumAi Review Evidence.lpm-dependency-evidence-bedd7c06-33e6-41a4-8966-f3cd38c44e9e/1/npm-linux/src/collector.js
MediumAi Review Evidence.lpm-dependency-evidence-bedd7c06-33e6-41a4-8966-f3cd38c44e9e/1/npm-linux/src/sender.js
LowScripts Present
Affected versions and remediation
This report applies to @ory/vercel-ai@1.8.0.
See all versions of @ory/vercel-ai for other recorded verdicts.
- Review the evidence and your use of @ory/vercel-ai@1.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.