@ory/amp 1.5.2

Details

Installing @ory/amp 1.5.2 installs its dependency reova 0.7.0, whose postinstall script runs node index.js. reova only runs when the depending package enables it in its package.json, as @ory/amp does (reova.enabled true, endpoint https://telemetry.reo.dev/data); installers can disable it by setting DO_NOT_TRACK=1 or REOVA_ANALYTICS=false before installing. At install time the script sends the package name and version, platform, operating system, CPU count, whether it runs in CI, a random per-install id, and the email domain (not the full address) read from the user's ~/.gitconfig to that endpoint over HTTPS. The installing user is not asked for consent. No credentials or source files are read, and nothing persists after the install. Impact: every developer and CI machine that installs the package without the opt-out discloses its employer's email domain and basic host details to a third-party analytics service. Remediation: set DO_NOT_TRACK=1 (or REOVA_ANALYTICS=false) in the build environment, install with --ignore-scripts where possible, or block telemetry.reo.dev on build hosts. Check whether newer versions still enable reova.