thalamus@1.3.0
Mobile and Web client for Claude Code
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a real cloud-controlled AI-agent capability with credential-handling and persistence implications, but the sensitive credential upload is explicitly user-invoked and the install hook is limited to unpacking local tools. The source does not establish covert install-time exfiltration or an unconsented foreign agent-control-surface mutation.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the thalamus CLI after authenticating.
Impact
A compromised or malicious package service could cause a user's Claude session to start attacker-selected MCP tools; the explicit connect command can also upload OAuth credentials to that service.
Mechanism
Cloud-delivered MCP command configuration and detached daemon startup.
AI rationale
This is a real cloud-controlled AI-agent capability with credential-handling and persistence implications, but the sensitive credential upload is explicitly user-invoked and the install hook is limited to unpacking local tools. The source does not establish covert install-time exfiltration or an unconsented foreign agent-control-surface mutation.
Evidence
package.jsonscripts/unpack-tools.cjsdist/index.cjsdist/types-Cdl8Y8g9.mjstools/unpacked~/.thalamus~/.claude/.credentials.json
Network endpoints2
thalamus.etai.appapi.anthropic.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The install hook extracts bundled archives and marks extracted binaries executable.
- The explicit connect command sends an Anthropic OAuth token object to the package's default cloud service.
- A cloud response supplies MCP server definitions, including commands and arguments, which are passed into a Claude launch configuration.
- Normal CLI startup detaches a background daemon after authentication.
Evidence against
- The install hook only invokes the local archive unpacker; it contains no network request or foreign agent-config write.
- Credential upload is behind the explicit `thalamus connect claude` command.
- No runtime dependency on thalamus itself is declared.
- The existing Claude OAuth token is used for an Anthropic usage request, not shown being sent to the package service.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
11 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { execFileSync } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L27// Ensure Node flags to reduce noisy warnings on stdout (which could interfere with MCP)
L8: const hasNoWarnings = process.execArgv.includes('--no-warnings');
L9: const hasNoDeprecation = process.execArgv.includes('--no-deprecation');
High
Findings
8 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShellbin/thalamus-mcp.mjs
HighCredential Redirect Persistencedist/index.cjs
HighCross File Remote Execution Contextdist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.mjs
MediumDynamic Requiredist/lib.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.cjs
MediumShips Compressed Blob
Affected versions and remediation
This report applies to thalamus@1.3.0.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.