Analysis · DiggingBeagle record
The package installs once; its agent configuration survives
Three npm analyses identify different crossings of an AI developer environment: postinstall telemetry, persistent MCP memory and setup-time credential reuse. The proof of a write is not proof of a leak.
- Published
- Oct 25, 2026
Overview
An npm package does not need to replace the coding agent binary to change what that agent does next. Ordinary installation scripts can write user-level configuration outside the project, and a setup routine can reuse credentials already available to the developer. Three October 2026 LPM package assessments trace distinct ways that authority crosses from a package into the agent environment. They should not be collapsed into a single malware campaign or counted as three confirmed compromises.
The actions begin at different times
| Package | Activation point described by the source | Result supported by inspection | Later effect requiring separate evidence |
|---|---|---|---|
| toga-ai | npm postinstall |
Writes global Claude Code settings that enable content-level OpenTelemetry and name an external collector | A later Claude session actually transmits prompts or tool content |
| common-context-mcp | npm postinstall |
Registers an MCP server in existing configurations for several coding-agent clients and directs persistent local context | That server executes during a later task, or transmits information to an outside destination |
| @mmerterden/multi-agent-pipeline | Explicit setup or first-run registration, not install alone | A registration code path retrieves a GitHub credential and prepares a bearer-authenticated request to the publisher service | The request is delivered, stored or subsequently used for account access |
The toga-ai report identifies global settings and the collector otel.togaiq.com; the common-context-mcp report identifies auto-registration across client settings and a local shared-context file. Both are source-linked static reports. The multi-agent-pipeline review describes a separate setup-time credential path, including the case where a reporting-token prompt is skipped. Its landing page can move to newer versions, so a current scanner finding is not proof that every historical package version behaved the same way.
The subtle transition is from dependency to future instruction
A dependency manager can install an intact archive and still let its lifecycle hook edit files that another, more privileged process will read later. For telemetry, the later process may send content after an independent user interaction. For an MCP server, the new registration expands the agent's future tool and memory context; whether any tool is called depends on the client. In the registration example, the boundary changes again: a token that authenticates the user to GitHub is offered to a publisher's usage system rather than being exchanged for a purpose-specific registration credential.
This distinction is not semantic. A package that has written ~/.claude/settings.json has changed a persistent input even when no network packet has yet been captured. Conversely, discovering a URL and a request-building function in package source is not a forensic record of successful remote receipt. The telemetry dossier, memory-registration dossier and credential-registration dossier preserve those separate evidentiary thresholds.
A narrow test that can settle each question
Run the exact reviewed package version inside a disposable profile with no real credentials. Record the package hash, lifecycle-script output and byte-level configuration diff before starting any coding agent. Then begin a new agent session with synthetic prompts and credentials, recording effective MCP tools, spawned processes and permitted outbound requests. For the explicit setup path, capture whether the synthetic GitHub token is actually delivered when the user skips the reporting-token question. Finally, uninstall and test whether the original settings are restored. This distinguishes install-time mutation, subsequent execution, actual disclosure and persistence after removal without relying on a scanner's confidence score as an observed loss.
The broader mechanism is package-driven agent-state persistence. Package provenance and lifecycle authority are separate checks: a correctly downloaded package can still perform a configuration change that should have required a different consent boundary.