toga-ai@1.0.1046
TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe post-install hook automatically enables content-bearing telemetry in global Claude Code settings and directs it to a package-selected collector. This is unconsented mutation of a foreign AI-agent control surface, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package through npm, unless TOGA_SKIP_TELEMETRY=1 is set in the installer environment.
Impact
Subsequent Claude Code telemetry may disclose prompts, assistant responses, tool details, and session metadata to that collector.
Mechanism
The hook writes telemetry and content-logging settings into ~/.claude/settings.json and selects the OTLP collector at otel.togaiq.com.
Policy narrative
The package's post-install hook automatically enables global Claude Code telemetry and prompt and tool-content logging, then points the exporter at otel.togaiq.com. This changes a foreign agent's settings without affirmative consent and can cause later disclosure of session content. The opt-out requires setting an environment variable before installation.
AI rationale
The post-install hook automatically enables content-bearing telemetry in global Claude Code settings and directs it to a package-selected collector. This is unconsented mutation of a foreign AI-agent control surface, so the package should be blocked.
Evidence
package.jsonscripts/install.js~/.claude/settings.json
Network endpoints1
otel.togaiq.com
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/install.js --post-install automatically during installation.
- The installer sets global Claude telemetry to an OTLP endpoint at otel.togaiq.com and enables content, prompt, and tool-detail logging.
- The installer writes these settings into ~/.claude/settings.json; telemetry is skipped only when TOGA_SKIP_TELEMETRY=1 is set.
- The settings mutation runs before the post-install branch exits, including for global installs.
Evidence against
- The installer preserves unmanaged settings and backs up an existing settings file.
- A user can prevent the telemetry change by setting TOGA_SKIP_TELEMETRY=1 before installation.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.js --post-install
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/install.js --post-install
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/install.jsView file
11* 3. If git available: use git repo as source (newer); otherwise use npm bundle silently
L12: * 4. Install from chosen source into project .claude/
L13: *
...
L35: // Team skills that were retired from the bundle. Install MOVES them out of a dev's
L36: // .claude/skills/ (to .claude/sk[redacted]/<name>-<yyyymmdd>) so they stop loading but
L37: // nothing is lost. Only moved when the bundle no longer ships them.
...
L100: try {
L101: fs.writeFileSync(CACHE_FILE, repoDir + '\n');
L102: } catch (e) { /* non-fatal */ }
...
L114: try {
L115: fs.mkdirSync(defaultDir, { recursive: true });
L116:
Findings
1 Critical15 High4 Medium5 Low
CriticalAi Agent Control Hijackscripts/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighExternal Ai Agent Control Surface Mutationscripts/install.js
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/install.js
HighSemantic Analysis Limitedskills/start/scripts/ticket-parse.js#virtual:normalized:round1
HighKnown Malware Source Similarityknowledge.js
HighKnown Malware Source Similarityscripts/hooks/start-gate.js
HighKnown Malware Source Similarityskills/commit/scripts/commit-helper.js
HighKnown Malware Source Similarityskills/start/scripts/start-helper.js
HighKnown Malware Source Similarityscripts/harness.js
Affected versions and remediation
This report applies to toga-ai@1.0.1046.
See all versions of toga-ai for other recorded verdicts.
- Avoid installing toga-ai@1.0.1046. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.