thalamus@1.5.10
Mobile and Web client for Claude Code
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInstall-time code unpacks and chmod's opaque native archives, and the required arm64 Linux archive has no readable source text, so the extracted payload stays unverified. Readable Claude session and OAuth paths are user-started and bound to the Anthropic usage API, which does not clear that install payload.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm install runs the postinstall script scripts/unpack-tools.cjs.
Impact
Install can place and mark executable whatever those archives contain. The contents were not inspectable, so a malicious binary cannot be ruled out or confirmed.
Mechanism
The script selects difftastic and ripgrep archives for the current platform, gunzips them into tools/unpacked with preserveMode, then chmod 755 on files that do not end in .node.
AI rationale
Install-time code unpacks and chmod's opaque native archives, and the required arm64 Linux archive has no readable source text, so the extracted payload stays unverified. Readable Claude session and OAuth paths are user-started and bound to the Anthropic usage API, which does not clear that install payload.
Evidence
package.jsonscripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gztools/unpacked
Decision evidence
public snapshotAI called this Suspicious at 66.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json postinstall runs node scripts/unpack-tools.cjs during npm install.
- unpack-tools.cjs gunzips the platform difftastic and ripgrep tar.gz archives into tools/unpacked and chmod 755 on every non-.node file.
- tools/archives/difftastic-arm64-linux.tar.gz is non-UTF8; it has no printable excerpt, so the install-time extracted executables cannot be verified.
Evidence against
- The .claude projects path only checks whether a session jsonl file exists when a session is resumed.
- The daemon reads the local Claude OAuth access token and sends it only to https://api.anthropic.com/api/oauth/usage; stored quota fields omit that token.
- bin/thalamus-mcp.mjs spawns the local dist MCP bridge with the current Node binary.
- dist/lib.cjs and dist/lib.mjs only re-export the API client, and package.json does not depend on its own name.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-DIqYZBbR.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = thalamus@1.4.6
matchedIdentity = npm:dGhhbGFtdXM:1.4.6
similarity = 0.353
summary = stored previous version shares package body but lacks this dangerous source file
Findings
3 Critical8 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/api-DIqYZBbR.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-DIqYZBbR.cjs
HighCredential Redirect Persistencedist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.cjs
HighKnown Malware Source Similaritydist/lib.mjs
Affected versions and remediation
This report applies to thalamus@1.5.10.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.