Loading npm security reports…

toga-ai@1.0.863: AI-agent control-surface risk | LPM Firewall

registry / toga-ai / 1.0.863

toga-ai@1.0.863

TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall rewrites the user-level Claude Code settings file and turns on OpenTelemetry export of prompts, assistant output, and tool details to otel.togaiq.com. The write runs even when the installer does not set up a project harness.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Automatic npm postinstall of toga-ai, which executes node scripts/install.js --post-install.

Impact

Later Claude Code sessions on that machine send user prompts, assistant responses, tool details, account UUID, and session id to the package operator endpoint.

Mechanism

reportTelemetryEnv merges a fixed env block into ~/.claude/settings.json, enabling Claude Code telemetry and pointing the OTLP exporter at https://otel.togaiq.com with a package-supplied bearer token. Opt-out requires TOGA_SKIP_TELEMETRY=1 before install.

Policy narrative

Installing toga-ai runs a postinstall script that updates the user Claude Code settings before any project setup. The script forces telemetry on and sets the exporter to https://otel.togaiq.com, including flags that log user prompts, assistant replies, and tool details, plus a bundled authorization header. A skip variable exists, but it is off by default, so a normal install redirects machine-wide agent content to the operator.

AI rationale

Postinstall unconditionally mutates the global Claude Code settings file to export prompt and tool content to a package-controlled collector. That is unconsented install-time control of a broad agent surface, not ordinary project setup.

Evidence

package.jsonscripts/install.js~/.claude/settings.json

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js --post-install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js --post-install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

11* 3. If git available: use git repo as source (newer); otherwise use npm bundle silently L12: * 4. Install from chosen source into project .claude/ L13: * ... L111: try { L112: fs.writeFileSync(CACHE_FILE, repoDir + '\n'); L113: } catch (e) { /* non-fatal */ } ... L125: try { L126: fs.mkdirSync(defaultDir, { recursive: true }); L127: ... L167: try { L168: fs.mkdirSync(path.dirname(defaultDir), { recursive: true }); L169: const result = spawnSync('git', ['clone', REPO_URL, defaultDir], {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L11

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: owledge base team knowledge lives in \`.claude/knowledge/\`. it is seeded from the npm bundle and grows every time any developer runs \`/capture\`. - search it: \`node .claude/knowledge.js search --q="payments"\` - validate it: \`node .claude/knowledge.js validate\` - re-index it: \`node .claude/knowledge.js index\` every time you edit a file inside \`.claude/knowledge/\`, the post-edit-validate hook runs automatically and warns you of any frontmatter or schema errors. --- ### updating pull latest skills, agents, and knowledge from the team repo: \`\`\` npx toga-ai \`\`\` `; if (fs.existssync(claudemdpath)) { const existing = fs.readfilesync(claudemdpath, 'utf8'); if (existing.includ

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = toga-ai@1.0.866 matchedPath = scripts/install.js matchedIdentity = npm:dG9nYS1haQ:1.0.866 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.jsView on unpkg

skills/migrate-github-org/migrate-github-org.shView file

•path = skills/migrate-github-org/migrate-github-org.sh kind = build_helper sizeBytes = 2434 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/migrate-github-org/migrate-github-org.shView on unpkg

scripts/hooks/kickoff-gate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/hooks/kickoff-gate.js#virtual:normalized:round1View on unpkg

knowledge.jsView file

•matchType = normalized_sha256 matchedPackage = toga-ai@1.0.866 matchedPath = knowledge.js matchedIdentity = npm:dG9nYS1haQ:1.0.866 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

knowledge.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5769fa4bb6490e69 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = toga-ai@1.0.866 matchedPath = knowledge.js matchedIdentity = npm:dG9nYS1haQ:1.0.866 similarity = 1.000 shingleOverlap = 26 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

knowledge.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = toga-ai@1.0.771 matchedIdentity = npm:dG9nYS1haQ:1.0.771 similarity = 0.458 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

knowledge.jsView on unpkg

scripts/harness.jsView file

•matchType = normalized_sha256 matchedPackage = toga-ai@1.0.866 matchedPath = scripts/harness.js matchedIdentity = npm:dG9nYS1haQ:1.0.866 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/harness.jsView on unpkg

scripts/hooks/post-edit-validate.jsView file

•matchType = normalized_sha256 matchedPackage = toga-ai@1.0.866 matchedPath = scripts/hooks/post-edit-validate.js matchedIdentity = npm:dG9nYS1haQ:1.0.866 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/hooks/post-edit-validate.jsView on unpkg

scripts/hooks/session-start.jsView file

•matchType = normalized_sha256 matchedPackage = toga-ai@1.0.866 matchedPath = scripts/hooks/session-start.js matchedIdentity = npm:dG9nYS1haQ:1.0.866 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/hooks/session-start.jsView on unpkg

skills/plan-ticket/scripts/clickup.jsView file

•matchType = normalized_sha256 matchedPackage = toga-ai@1.0.866 matchedPath = skills/plan-ticket/scripts/clickup.js matchedIdentity = npm:dG9nYS1haQ:1.0.866 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/plan-ticket/scripts/clickup.jsView on unpkg

scripts/hooks/kickoff-gate.jsView file

•matchType = normalized_sha256 matchedPackage = toga-ai@1.0.866 matchedPath = scripts/hooks/kickoff-gate.js matchedIdentity = npm:dG9nYS1haQ:1.0.866 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/hooks/kickoff-gate.jsView on unpkg

scripts/hooks/sql-cross-cluster-check.jsView file

•matchType = normalized_sha256 matchedPackage = toga-ai@1.0.866 matchedPath = scripts/hooks/sql-cross-cluster-check.js matchedIdentity = npm:dG9nYS1haQ:1.0.866 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/hooks/sql-cross-cluster-check.jsView on unpkg

skills/plan-ticket/scripts/talos.jsView file

•matchType = normalized_sha256 matchedPackage = toga-ai@1.0.866 matchedPath = skills/plan-ticket/scripts/talos.js matchedIdentity = npm:dG9nYS1haQ:1.0.866 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/plan-ticket/scripts/talos.jsView on unpkg