thalamus@1.3.1
Mobile and Web client for Claude Code
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes a real remote AI-agent control capability, but the inspected install hook does not modify a foreign agent configuration or contact the network. This is a high-risk remote-execution design rather than conclusive evidence of covert malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review
Trigger
Running the Thalamus CLI or its authenticated session workflow.
Impact
A compromised or malicious service account can cause commands, reads, and writes in the user-selected project.
Mechanism
Remote MCP configuration plus authenticated project-scoped command and file RPC.
AI rationale
The source establishes a real remote AI-agent control capability, but the inspected install hook does not modify a foreign agent configuration or contact the network. This is a high-risk remote-execution design rather than conclusive evidence of covert malicious behavior.
Evidence
package.jsonscripts/unpack-tools.cjsdist/types-BAJ-bLBn.cjsdist/index.cjsbin/thalamus-mcp.mjsdist/lib.mjstools/archives/difftastic-arm64-linux.tar.gztools/unpackedprocess.cwd()~/.thalamus
Network endpoints1
thalamus.etai.app
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Its install hook automatically unpacks bundled platform binaries.
- The client connects to a fixed service endpoint using an authenticated session token.
- Authenticated RPC handlers can execute shell commands and read or write files in the active working directory.
- The client loads enabled MCP server commands and arguments from its remote registry.
- It injects managed agents and hooks into a Claude session at runtime.
- The MCP launcher executes the package’s bridge process and forwards the caller environment.
Evidence against
- The install hook only extracts package-bundled archives; no install-time network request is present in the inspected installer.
- The shell and file handlers enforce a session working-directory boundary.
- No lifecycle self-dependency or automatic write to a foreign AI-agent configuration was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { execFileSync } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L27// Ensure Node flags to reduce noisy warnings on stdout (which could interfere with MCP)
L8: const hasNoWarnings = process.execArgv.includes('--no-warnings');
L9: const hasNoDeprecation = process.execArgv.includes('--no-deprecation');
High
Findings
1 Critical8 High6 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShellbin/thalamus-mcp.mjs
HighCredential Redirect Persistencedist/index.cjs
HighCross File Remote Execution Contextdist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.mjs
MediumDynamic Requiredist/lib.cjs
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to thalamus@1.3.1.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.