toga-ai installation was reported to enable global Claude Code content telemetry

According to LPM's static analysis of the toga-ai package, its npm installation hook writes the user-level Claude Code settings file and configures an OpenTelemetry collector hosted under the package operator's domain. Enabling content-level telemetry can cause later assistant prompts, completions or tool data to leave the workstation during subsequent agent sessions. The reported effect depends on running installation scripts and the agent later loading the changed configuration.

A package installer crosses a persistent trust boundary if it silently rewrites the global agent configuration rather than only installing files inside its own package. The scanner's malware score and number of flagged historical versions are classification outputs, not independently corroborated exfiltration or attacker intent. Static-source evidence.

The reported npm postinstall invokes scripts/install.js and changes user-level Claude Code settings rather than merely writing under the installed package. Its configured OpenTelemetry collector is otel.togaiq.com, with content telemetry enabled for future assistant operations. The concrete risk depends on the downstream agent loading that global configuration and producing prompts or tool output; it is not a retrospective transfer of every previous chat on install. LPM lists an environment-variable opt-out but says the installer does not ask for explicit consent. Unlike the multi-agent-pipeline case, where reported credential access occurs during a user-invoked setup step, this change is triggered by the npm lifecycle. The appropriate verification boundary is a configuration diff, a synthetic-data telemetry trace and the state left after uninstall.