thalamus@1.4.2
Mobile and Web client for Claude Code
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package exposes a real remote control surface for Claude MCP commands and an explicit cloud credential-transfer feature. These are risky capabilities, but inspection found no automatic credential exfiltration or foreign AI-agent mutation during installation.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Run thalamus after authentication, or run thalamus connect claude.
Impact
A compromised or malicious service account can influence MCP commands made available to Claude; the explicit connect flow transfers an Anthropic OAuth token to the service.
Mechanism
Remote MCP command injection and cloud token registration.
AI rationale
The package exposes a real remote control surface for Claude MCP commands and an explicit cloud credential-transfer feature. These are risky capabilities, but inspection found no automatic credential exfiltration or foreign AI-agent mutation during installation.
Evidence
dist/index.cjsdist/types-B5iGoS-T.cjsscripts/unpack-tools.cjspackage.jsontools/unpacked~/.thalamus/settings.json~/.thalamus/access.key
Network endpoints2
thalamus.etai.appthalamus.etai.app/v1/connect/anthropic/register
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The install hook extracts bundled archives and marks extracted files executable.
- The CLI defaults to a vendor-controlled remote service and stores local state under the user home directory.
- An explicit connect command obtains Anthropic OAuth tokens and uploads them to the remote service.
- At session startup, remote MCP definitions supply command, arguments, and environment values that are passed into the Claude session.
- An environment-controlled debug mode can send unencrypted logs to a configured remote server.
Evidence against
- The postinstall script is limited to package-local tool extraction and has no network operation.
- OAuth-token upload requires the explicit thalamus connect claude command.
- Remote logging requires two opt-in environment variables.
- No automatic lifecycle hook reads Claude credentials, uploads credentials, or mutates Claude configuration.
- No runtime dependency on another thalamus release was found.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/lib.cjsView file
•matchType = token_shingles
matchedPackage = claudeputer@1.1.41
matchedPath = dist/lib.cjs
matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib.cjsView on unpkg2L3: var types = require('./types-B5iGoS-T.cjs');
L4: require('axios');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lib.cjsView on unpkg · L2Findings
7 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.cjs
HighKnown Malware Source Similaritydist/lib.mjs
HighPrevious Version Dangerous Deltadist/index.cjs
MediumDynamic Requiredist/lib.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.cjs
MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz
Affected versions and remediation
This report applies to thalamus@1.4.2.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.