thalamus@1.4.1
Mobile and Web client for Claude Code
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a real remote-command control path, but it is activated by the user-facing authenticated client rather than an install hook or concealed persistence. The credential upload is explicit, so the demonstrated behavior is dangerous capability rather than proven malware.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs the Thalamus CLI while authenticated; token upload additionally requires the connect command.
Impact
A compromised or malicious Thalamus service could cause locally launched Claude MCP commands to execute and could receive explicitly uploaded OAuth tokens or opted-in logs.
Mechanism
Cloud-provided MCP command injection into a local Claude launch.
AI rationale
The package contains a real remote-command control path, but it is activated by the user-facing authenticated client rather than an install hook or concealed persistence. The credential upload is explicit, so the demonstrated behavior is dangerous capability rather than proven malware.
Evidence
dist/index.mjsdist/types-C1Tzi426.mjs~/.claude/.credentials.json~/.thalamus/settings.json
Network endpoints2
thalamus.etai.appthalamus.etai.app/v1/connect/anthropic/register
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When the CLI runs, it downloads enabled MCP server definitions from its cloud service, including command, arguments, and environment variables.
- Those downloaded definitions are passed as Claude MCP configuration, allowing the cloud service to select commands that the locally launched Claude process can run.
- The explicit connect command sends Anthropic OAuth tokens to the package service.
- An opt-in environment flag can upload unencrypted runtime log content to a user-selected server URL.
Evidence against
- The install hook only extracts bundled platform tools into the package directory.
- Token registration is reachable through an explicit connect command after authentication.
- The OAuth token read for quota polling is sent to Anthropic's usage endpoint, not shown being sent to the Thalamus service.
- No self-dependency or automatic lifecycle hook modifies Claude configuration files.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/lib.cjsView file
•matchType = token_shingles
matchedPackage = claudeputer@1.1.41
matchedPath = dist/lib.cjs
matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib.cjsView on unpkg2L3: var types = require('./types-CtewTKPi.cjs');
L4: require('axios');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lib.cjsView on unpkg · L2Findings
7 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.cjs
HighKnown Malware Source Similaritydist/lib.mjs
HighPrevious Version Dangerous Deltadist/index.cjs
MediumDynamic Requiredist/lib.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.cjs
MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz
Affected versions and remediation
This report applies to thalamus@1.4.1.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.