Evidence · DiggingBeagle record
LPM static security assessment of toga-ai npm install hook
Source-linked scanner report on install-time edits to global Claude Code telemetry settings; no confirmed delivery of private prompts.
- Source role
- primary disclosure
Evidence record
Source-linked scanner report on install-time edits to global Claude Code telemetry settings; no confirmed delivery of private prompts.
Claim-level citations (3)
- supportstoga-ai installation was reported to enable global Claude Code content telemetry: LPM identifies toga-ai 1.0.1146 package installation as the trigger for writing Claude Code global settings and names otel.togaiq.com as the configured collector; an environment-variable opt-out exists.
AI Security Review, Trigger, Evidence against and Network endpoints
- supportstoga-ai installation was reported to enable global Claude Code content telemetry: LPM reports that toga-ai postinstall modifies user-level Claude Code settings and configures OTLP content telemetry pointing to otel.togaiq.com.
Automated behavioral assessment; postinstall file modifications
- supportstoga-ai installation was reported to enable global Claude Code content telemetry: The scanner report documents a configuration and potential future telemetry path, not a captured transfer of historical chats or confirmed credential theft.
Report scope; observed versus inferred behavior