thalamus@1.5.106
Mobile and Web client for Claude Code
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe reviewed flagged behavior has an ordinary purpose: postinstall extracts bundled tools, OAuth usage data goes to Anthropic, and GitHub credentials are scoped to GitHub. Vendor token registration targets the configured Thalamus service; no unrelated exfiltration or concealed payload execution was confirmed.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Postinstall unpacks bundled tools; runtime network and process actions occur in CLI or service features.
Impact
No unauthorized credential transfer, persistence, or unrelated remote execution was established.
Mechanism
The postinstall extracts package archives locally. OAuth usage requests target Anthropic, Git credentials are scoped to GitHub, and vendor token registration uses the configured Thalamus server.
AI rationale
The reviewed flagged behavior has an ordinary purpose: postinstall extracts bundled tools, OAuth usage data goes to Anthropic, and GitHub credentials are scoped to GitHub. Vendor token registration targets the configured Thalamus service; no unrelated exfiltration or concealed payload execution was confirmed.
Evidence
tools/unpacked
Network endpoints3
api.anthropic.comgithub.comConfigured logger.configuration.serverUrl
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall script unpacks bundled platform tools from package archives and does not contact a network host.
- Anthropic OAuth usage requests send the token to Anthropic's own API endpoint.
- The Git credential helper is scoped to github.com; vendor token registration uses the configured Thalamus server URL.
Evidence against
- The package has a postinstall hook that writes unpacked tools into tools/unpacked.
- The source includes process execution for launching the CLI and helper tools.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
20 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-dkIwOn83.mjsView file
1244L1245: const execAsync = promisify(exec$4);
L1246: const pathModule = path__default;
High
Findings
3 Critical13 High6 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-DpHDXjZm.cjs
CriticalEncrypted Payload Temp Executiondist/api-DSGbn1pv.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-DSGbn1pv.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-dkIwOn83.mjs
HighSame File Env Network Executiondist/api-dkIwOn83.mjs
HighCredential Redirect Persistencedist/api-DSGbn1pv.cjs
HighCommand Output Exfiltrationdist/api-dkIwOn83.mjs
HighSandbox Evasion Gated Capabilitydist/api-dkIwOn83.mjs
HighCross File Remote Execution Contextdist/api-DSGbn1pv.cjs
Affected versions and remediation
This report applies to thalamus@1.5.106.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.106 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.