thalamus@1.3.3
Mobile and Web client for Claude Code
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package exposes concrete remote command execution and credential-upload capabilities, creating meaningful abuse risk. The install hook is transparent package-local archive extraction, and the credential flow is explicitly user-invoked, so static source does not establish malicious install-time behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running a Thalamus session connected to its service, or explicitly running thalamus connect claude.
Impact
A compromised or abusive service account could run commands within the active project session; users who invoke credential connection disclose tokens to the service.
Mechanism
Remote RPC shell execution and user-invoked vendor-token upload.
AI rationale
The package exposes concrete remote command execution and credential-upload capabilities, creating meaningful abuse risk. The install hook is transparent package-local archive extraction, and the credential flow is explicitly user-invoked, so static source does not establish malicious install-time behavior.
Evidence
dist/types-BwfyJoJS.cjsdist/index.cjsprocess.cwd()
Network endpoints1
thalamus.etai.app
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A runtime WebSocket session registers RPC handlers and accepts remote RPC requests from the configured service.
- The remote "bash" handler passes a received command string to a shell executor in the active session directory.
- The explicit connect command obtains Anthropic authentication tokens and sends them to the Thalamus service.
Evidence against
- The postinstall hook only unpacks bundled tools under the package's own tools directory.
- Token registration is reached through the explicit "thalamus connect claude" command, not during installation.
- The shell handler restricts its working directory to the session directory and caps execution time.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/lib.cjsView file
2L3: var types = require('./types-BwfyJoJS.cjs');
L4: require('axios');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lib.cjsView on unpkg · L2dist/index.cjsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.cjs:
var readline = require('node:readline');
var readline__namespace = /*#__PURE__*/_interopNamespaceDefault(readline);
this.claudeEnvVars = opts.claudeEnvVars;
this.claudeArgs = opts.claudeArgs;
if (!this.claudeArgs) return;
for (let i = 0; i < this.claudeArgs.length; i++) {
if (this.claudeArgs[i] === "--resume") {
if (i + 1 < this.claudeArgs.length) {
Findings
6 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.mjs
HighPrevious Version Dangerous Deltadist/index.cjs
MediumDynamic Requiredist/lib.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.cjs
MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to thalamus@1.3.3.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.3.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.