software_project · DiggingBeagle record
toga-ai npm package
Developer-tool package whose install hook reportedly changes global Claude Code telemetry.
- Entity kind
- software_project
Record description
The toga-ai npm package contains an install hook described by LPM as changing user-level Claude Code telemetry configuration, with future content reporting directed to a publisher endpoint. This is a configuration and consent boundary finding, not confirmed credential exfiltration or a verified compromise of previous conversations.
The package scanner identifies toga-ai 1.0.1146 postinstall configuration of Claude Code OpenTelemetry collection at otel.togaiq.com, including content telemetry. The observed concern is a configuration write; no independent runtime test in this session established historical prompt transfer, recipient receipt or malign intent.