thalamus@1.3.2
Mobile and Web client for Claude Code
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source exposes powerful remote agent control, credential handling, optional log upload, and persistence, so it warrants a warning. The install hook only unpacks bundled tools, and no unconsented credential exfiltration or install-time control-surface mutation was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review
Trigger
Running the thalamus CLI starts its daemon; running thalamus connect claude transfers a token; setting the remote-log variables uploads logs; thalamus daemon install creates persistence.
Impact
A user who enables these features grants the package broad control of Claude sessions and access to authentication material; an unsafe configured log endpoint could receive diagnostic content.
Mechanism
Remote Claude orchestration with credential access, optional log upload, and explicit daemon persistence.
AI rationale
The source exposes powerful remote agent control, credential handling, optional log upload, and persistence, so it warrants a warning. The install hook only unpacks bundled tools, and no unconsented credential exfiltration or install-time control-surface mutation was found.
Evidence
dist/index.cjsdist/types-EcYPGjBE.cjs~/.claude/.credentials.json~/.thalamus/Library/LaunchDaemons/com.thalamus-cli.daemon.plist
Network endpoints3
thalamus.etai.appapi.anthropic.comTHALAMUS_SERVER_URL
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The normal CLI path starts a detached background daemon.
- The code reads the Claude OAuth credential file to obtain an access token.
- The explicit connect command registers Anthropic OAuth tokens with the Thalamus service.
- An environment-controlled option posts unencrypted diagnostic logs to its configured server.
- The explicit daemon installer creates a persistent macOS root launch daemon.
Evidence against
- The postinstall hook only unpacks bundled local archives into the package tools directory.
- Sending an Anthropic token to Thalamus requires the user to run the connect command.
- Remote log upload requires both explicit environment variables.
- The persistent daemon install is a separate command and requires root privileges.
- No self-dependency, install-time network request, or automatic mutation of Claude configuration was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/types-EcYPGjBE.cjsView file
2L3: var axios = require('axios');
L4: var chalk = require('chalk');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/types-EcYPGjBE.cjsView on unpkg · L2dist/index.cjsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.cjs:
var readline = require('node:readline');
var readline__namespace = /*#__PURE__*/_interopNamespaceDefault(readline);
this.claudeEnvVars = opts.claudeEnvVars;
this.claudeArgs = opts.claudeArgs;
if (!this.claudeArgs) return;
for (let i = 0; i < this.claudeArgs.length; i++) {
if (this.claudeArgs[i] === "--resume") {
if (i + 1 < this.claudeArgs.length) {
Findings
6 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighPrevious Version Dangerous Deltadist/index.cjs
HighKnown Malware Source Similaritydist/lib.mjs
MediumDynamic Requiredist/types-EcYPGjBE.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.cjs
MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to thalamus@1.3.2.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.3.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.