Loading npm security reports…
thalamus@1.5.105: Telemetry – npm package flagged | LPM Firewall
Flagged — allowed with a warning
Allowed by default policy, but 29 finding(s) warrant review before installing.
scanned 4d ago · by lpm-firewall-ai The source shows default runtime telemetry that includes the machine hostname and sends it to the package's service. This is a warning-level telemetry concern; the inspected flow does not show credential or file-content exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review
Trigger
Thalamus daemon startup for accounts not using orgDirect encryption; collection repeats every minute.
Impact
The service receives identifying host information and machine resource details without an evident disclosure or opt-out in the inspected source.
Mechanism
Samples include the OS hostname and GPU/RAM metrics, are encrypted, and are posted with the account token and machine ID.
AI rationale
The source shows default runtime telemetry that includes the machine hostname and sends it to the package's service. This is a warning-level telemetry concern; the inspected flow does not show credential or file-content exfiltration.
Evidence
dist/index-Cw55HOwk.cjs dist/logger-Cjf8II-C.cjs
Network endpoints1
thalamus.etai.app /v1/telemetry (default; server can be overridden with THALAMUS_SERVER_URL)
public snapshot AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
Daemon startup begins periodic host telemetry collection for accounts not using orgDirect encryption. Telemetry samples include the machine hostname alongside GPU and RAM metrics. The samples are encrypted and sent to the configured server's /v1/telemetry endpoint with the account token and machine ID. The default server is thalamus.etai.app; no telemetry disclosure or disable control was found in the inspected source. Evidence against
The collected data is limited to host resource metrics and hostname; no credentials, files, prompts, or command output are included in this telemetry flow. The endpoint belongs to the package's own service, and the payload is encrypted before transmission. Behavioral surface
Source ChildProcess Crypto EnvironmentVars Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings UrlStrings
21 flagged • scripts.postinstall = node scripts/unpack-tools.cjs
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg 2 L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High Child Process
Package source references child process execution.
bin/thalamus-mcp.mjs View on unpkg · L2 9 var persistence = require('./persistence-D4iENX5H.cjs');
L10: var child_process = require('child_process');
L11: var psList = require('ps-list');
...
L14: var path = require('node:path');
L15: var axios = require('axios');
L16: var fs$2 = require('fs/promises');
...
L104: }
L105: const body = await res.json().catch(() => null);
L106: if (res.status === 404) return body?.error === "Not found" ? { kind: "not-found" } : { kind: "retry" };
...
L556: }
L557: if (process.platform !== "darwin") {
L558: logger.logger.debug("[caffeinate] Not on macOS, skipping caffeinate");
4 Critical 13 High 6 Medium 6 Low
Critical Hardcoded Runtime Data Exfiltration dist/index-Cw55HOwk.cjs
Critical Encrypted Payload Temp Execution dist/index-Cw55HOwk.cjs
Critical Trigger Reachable Dangerous Capability dist/api-B3bUcH_X.cjs
Critical Previous Version Dangerous Delta dist/index-Cw55HOwk.cjs
High Install Time Lifecycle Scripts package.json
High Child Process bin/thalamus-mcp.mjs
High Shell dist/index-Cw55HOwk.cjs
High Same File Env Network Execution dist/api-B3bUcH_X.cjs
High Credential Redirect Persistence dist/api-B3bUcH_X.cjs
High Command Output Exfiltration dist/api-B3bUcH_X.cjs
High Sandbox Evasion Gated Capability dist/index-Cw55HOwk.cjs
Affected versions and remediation This report applies to thalamus@1.5.105 .
See all versions of thalamus for other recorded verdicts.
Review the evidence and your use of thalamus@1.5.105 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-11-01 10:32:41.424Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
Manifest No manifest risk signals triggered.
scanned 41 file(s), 7.18 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, claude.ai, console.anthropic.com, etai.app, github.com, github.com.helper, registry.npmjs.org, thalamus.etai.app, veriscia.com, www.apple.com
Critical Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index-Cw55HOwk.cjs View on unpkg · L9 • context = ] ?? 0;\n if (va > vb) return 1;\n if (va < vb) return -1;\n }\n return 0;\n}\nfunction isCacheUsable(cached, currentVersion, now) {\n if (!cached) return false;\n if (now - cached.checkedAt >= CACHE_TTL_MS) return false;\n if (compareSemver(currentVersion, cached.latestVersion) > 0) return false;\n return true;\n}\nfunction readCache() {\n try {\n const raw = node_fs.readFileSync(CACHE_FILE, "utf-8");\n return JSON.parse(raw);\n } catch {\n return null;\n }\n}\nfunction writeCache(cache) {\n try {\n node_fs.writeFileSync(CACHE_FILE, JSON.stringify(cache), "utf-8");\n } catch {\n }\n}\nasync function fetchLatestVersion() {\n try {\n const response = await axios.get(\n `https://registry.npmjs.org/${NPM_PACKAGE_NAME}/latest`,\n { timeout:
Critical Encrypted Payload Temp Execution
Source decrypts an embedded payload, writes it to disk, and executes it through a child process.
dist/index-Cw55HOwk.cjs View on unpkg • matchType = previous_version_dangerous_delta
matchedPackage = thalamus@1.5.108
matchedIdentity = npm:dGhhbGFtdXM:1.5.108
similarity = 0.898
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index-Cw55HOwk.cjs View on unpkg 4042 const { stdout } = await exec$3(
L4043: "powershell.exe",
L4044: ["-NoProfile", "-NonInteractive", "-Command", WIN_PROCESS_QUERY],
9 var persistence = require('./persistence-D4iENX5H.cjs');
L10: var child_process = require('child_process');
L11: var psList = require('ps-list');
...
L14: var path = require('node:path');
L15: var axios = require('axios');
L16: var fs$2 = require('fs/promises');
...
L104: }
L105: const body = await res.json().catch(() => null);
L106: if (res.status === 404) return body?.error === "Not found" ? { kind: "not-found" } : { kind: "retry" };
...
L556: }
L557: if (process.platform !== "darwin") {
L558: logger.logger.debug("[caffeinate] Not on macOS, skipping caffeinate");
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index-Cw55HOwk.cjs View on unpkg · L9 9 Trigger-reachable persistence chain: manifest.main -> dist/index.cjs -> dist/index-Cw55HOwk.cjs
L9: var persistence = require('./persistence-D4iENX5H.cjs');
L10: var child_process = require('child_process');
L11: var psList = require('ps-list');
...
L14: var path = require('node:path');
L15: var axios = require('axios');
L16: var fs$2 = require('fs/promises');
...
L104: }
L105: const body = await res.json().catch(() => null);
L106: if (res.status === 404) return body?.error === "Not found" ? { kind: "not-found" } : { kind: "retry" };
...
L556: }
L557: if (process.platform !== "darwin") {
L558: logger.logger.debug("[caffeinate] Not on macOS, skipping caffeinate");
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index-Cw55HOwk.cjs View on unpkg · L9 9 var persistence = require('./persistence-D4iENX5H.cjs');
L10: var child_process = require('child_process');
L11: var psList = require('ps-list');
...
L14: var path = require('node:path');
L15: var axios = require('axios');
L16: var fs$2 = require('fs/promises');
...
L104: }
L105: const body = await res.json().catch(() => null);
L106: if (res.status === 404) return body?.error === "Not found" ? { kind: "not-found" } : { kind: "retry" };
...
L556: }
L557: if (process.platform !== "darwin") {
L558: logger.logger.debug("[caffeinate] Not on macOS, skipping caffeinate");
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index-Cw55HOwk.cjs View on unpkg · L9 9 var persistence = require('./persistence-D4iENX5H.cjs');
L10: var child_process = require('child_process');
L11: var psList = require('ps-list');
...
L14: var path = require('node:path');
L15: var axios = require('axios');
L16: var fs$2 = require('fs/promises');
...
L104: }
L105: const body = await res.json().catch(() => null);
L106: if (res.status === 404) return body?.error === "Not found" ? { kind: "not-found" } : { kind: "retry" };
...
L556: }
L557: if (process.platform !== "darwin") {
L558: logger.logger.debug("[caffeinate] Not on macOS, skipping caffeinate");
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/index-Cw55HOwk.cjs View on unpkg · L9 2 Trigger-reachable chain: manifest.main -> dist/index.cjs -> dist/api-B3bUcH_X.cjs
L2:
L3: var axios = require('axios');
L4: var logger = require('./logger-Cjf8II-C.cjs');
...
L9: var node_crypto = require('node:crypto');
L10: var child_process = require('child_process');
L11: var util = require('util');
...
L60: c: z.z.string(),
L61: // Base64 encoded encrypted content
L62: t: z.z.literal("encrypted")
...
L82: // matches server's buildUpdateSessionUpdate wire format (was incorrectly 'sid')
L83: metadata: z.z.object({
L84: version: z.z.number(),
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/api-B3bUcH_X.cjs View on unpkg · L2 13995 try {
L13996: return node_child_process.execFileSync(cmd, args, { encoding: "utf8", env, timeout: 5e3, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
L13997: } catch {
...
L14007: try {
L14008: const env = stripGitEnv(stripSpawnEnvForChildTools(opts.env ?? process.env), GIT_TRANSPORT_ENV_KEEP);
L14009: const entries = parseHelperEntries(run("git", ["-C", dir, "config", "--show-origin", "--get-all", HELPER_KEY], env));
L14010: if (entries.length === 0) {
L14011: return `git has no credential helper for https://github.com in ${dir}. Fix: configure the bot credential in this OS user's git config (includeIf for the worktree roots, e.g. ~/.con...
L14012: }
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/api-B3bUcH_X.cjs View on unpkg · L13995 • Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/api-B3bUcH_X.cjs:
var readline = require('node:readline');
rpcHandlerManager.registerHandler("writeFile", async (data) => {
await fs.writeFile(resolvedPath, buffer);
node_fs.writeFileSync(tmp, JSON.stringify(rollup.toState(Date.now())));
return isServerUrl(config.baseURL ? new URL(url, config.baseURL) : url);
const sent = bearerToken(config.headers?.["Authorization"]);
config.headers["Authorization"] = `Bearer ${currentToken(sent)}`;
const sent = bearerToken(config.headers?.["Authorization"]);
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/api-B3bUcH_X.cjs View on unpkg 2 L3: var axios = require('axios');
L4: var logger = require('./logger-Cjf8II-C.cjs');
...
L9: var node_crypto = require('node:crypto');
L10: var child_process = require('child_process');
L11: var util = require('util');
...
L60: c: z.z.string(),
L61: // Base64 encoded encrypted content
L62: t: z.z.literal("encrypted")
...
L82: // matches server's buildUpdateSessionUpdate wire format (was incorrectly 'sid')
L83: metadata: z.z.object({
L84: version: z.z.number(),
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/api-B3bUcH_X.cjs View on unpkg · L2 2 Cross-file remote execution chain: dist/api-B3bUcH_X.cjs spawns dist/logger-Cjf8II-C.cjs; helper contains network access plus dynamic code execution.
L2:
L3: var axios = require('axios');
L4: var logger = require('./logger-Cjf8II-C.cjs');
...
L9: var node_crypto = require('node:crypto');
L10: var child_process = require('child_process');
L11: var util = require('util');
...
L60: c: z.z.string(),
L61: // Base64 encoded encrypted content
L62: t: z.z.literal("encrypted")
...
L82: // matches server's buildUpdateSessionUpdate wire format (was incorrectly 'sid')
L83: metadata: z.z.object({
L84: version: z.z.number(),
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/api-B3bUcH_X.cjs View on unpkg · L2 • path = scripts/sync-hud-core.sh
kind = build_helper
sizeBytes = 988
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/sync-hud-core.sh View on unpkg tools/archives/difftastic-arm64-linux.tar.gz View file • path = tools/archives/difftastic-arm64-linux.tar.gz
kind = high_entropy_blob
sizeBytes = 11425536
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
tools/archives/difftastic-arm64-linux.tar.gz View on unpkg • path = tools/archives/difftastic-arm64-linux.tar.gz
kind = compressed_blob
sizeBytes = 11425536
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
tools/archives/difftastic-arm64-linux.tar.gz View on unpkg • matchType = token_shingles
matchedPackage = claudeputer@1.1.41
matchedPath = dist/index.cjs
matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41
similarity = 0.775
shingleOverlap = 31
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.cjs View on unpkg • matchType = token_shingles
matchedPackage = claudeputer@1.1.41
matchedPath = dist/lib.cjs
matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41
similarity = 0.771
shingleOverlap = 37
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib.cjs View on unpkg • matchType = token_shingles
matchedPackage = claudeputer@1.1.41
matchedPath = dist/index.mjs
matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41
similarity = 0.725
shingleOverlap = 29
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.mjs View on unpkg High Cross File Remote Execution Context dist/api-B3bUcH_X.cjs
High Trigger Reachable Persistence dist/index-Cw55HOwk.cjs
High Ships High Entropy Blob tools/archives/difftastic-arm64-linux.tar.gz
High Known Malware Source Similarity dist/index.cjs
High Known Malware Source Similarity dist/lib.cjs
High Known Malware Source Similarity dist/index.mjs
Medium Install Persistence dist/index-Cw55HOwk.cjs
Medium Ships Build Helper scripts/sync-hud-core.sh
Medium Ships Compressed Blob tools/archives/difftastic-arm64-linux.tar.gz
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Weak Crypto dist/index-Cw55HOwk.cjs
module → ./dist/index.mjs
types → ./dist/index.d.cts
exports map
bin → thalamus, thalamus-mcp
Runtime No engine / OS / CPU constraints
Artifact 102 MB · 67 files 2 signature(s)
Install lifecycle postinstall prepublishOnly
Behavioral surface ChildProcess Crypto EnvironmentVars Filesystem Network Shell WebSocket HighEntropyStrings UrlStrings Manifest: clean