thalamus@1.5.104
Mobile and Web client for Claude Code
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe install hook unpacks bundled tools locally. The flagged credential flows are either sent to Anthropic’s own endpoint for quota data or sent to Thalamus cloud only through its documented, explicit connect command.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installation unpacks bundled tools; quota checks run during CLI use; token registration requires the explicit connect command.
Impact
Expected product behavior; no unauthorized credential transfer or unrelated execution was found in the reviewed paths.
Mechanism
The install hook extracts local archives. The quota check sends a Claude OAuth token to Anthropic, and the documented connect command registers a token with Thalamus cloud.
AI rationale
The install hook unpacks bundled tools locally. The flagged credential flows are either sent to Anthropic’s own endpoint for quota data or sent to Thalamus cloud only through its documented, explicit connect command.
Evidence
scripts/unpack-tools.cjstools/archives/difftastic-${platformDir}.tar.gztools/archives/ripgrep-${platformDir}.tar.gz~/.claude/.credentials.json
Network endpoints2
api.anthropic.comthalamus.etai.app
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall runs a local script that unpacks bundled difftastic and ripgrep archives; no install-time network behavior was identified.
- The quota lookup reads Claude’s OAuth token and sends it to Anthropic’s official OAuth usage endpoint.
- Sending an Anthropic token to Thalamus is part of the documented, explicit `thalamus connect claude` command, which says the token is stored in Thalamus cloud.
- Remote log shipping requires an opt-in environment variable and is restricted to a loopback server.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
21 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-x62VldQZ.cjsView file
•context = return { rollup: UsageRollup.fromState(JSON.parse(node_fs.readFileSync(path, "utf8"))), existed: true };\n } catch (error) {\n logger.logger.warn(`[usage] unreadable rollup state ${path}, starting fresh:`, error);\n return { rollup: new UsageRollup(), existed: false };\n }\n}\nfunction saveRollup(name, rollup, dir = usageStateDir()) {\n const path = usageStatePath(name, dir);\n if (!path) return;\n const tmp = `${path}.${process.pid}.tmp`;\n try {\n node_fs.mkdirSync(dir, { recursive: true });\n node_fs.writeFileSync(tmp, JSON.stringify(rollup.toState(Date.now())));\n node_fs.renameSync(tmp, path);\n } catch (error) {\n logger.logger.warn(`[usage] could not persist rollup ${path}:`, error);\n try {\n node_fs.unlinkSync(tmp);\n } catch {\n }\
Findings
4 Critical13 High6 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-DYHh2TUX.cjs
CriticalEncrypted Payload Temp Executiondist/api-x62VldQZ.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-x62VldQZ.cjs
CriticalPrevious Version Dangerous Deltadist/index-DYHh2TUX.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-x62VldQZ.cjs
HighSame File Env Network Executiondist/api-x62VldQZ.cjs
HighCredential Redirect Persistencedist/api-x62VldQZ.cjs
HighCommand Output Exfiltrationdist/api-x62VldQZ.cjs
HighSandbox Evasion Gated Capabilitydist/api-x62VldQZ.cjs
Affected versions and remediation
This report applies to thalamus@1.5.104.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.104 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.