thalamus@1.5.107
Mobile and Web client for Claude Code
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe install hook extracts bundled platform tools, and the inspected credential flows are scoped to GitHub sessions or use Anthropic’s own service. The reviewed evidence does not support the scanner’s exfiltration or concealed-execution claims.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review
Trigger
The postinstall hook extracts bundled tools; other credential and network behavior is used by relevant CLI features or explicit commands.
Impact
No malicious impact identified in the reviewed paths.
Mechanism
The extractor unpacks local archives, Git credentials are scoped to GitHub sessions, and Claude OAuth requests target Anthropic.
AI rationale
The install hook extracts bundled platform tools, and the inspected credential flows are scoped to GitHub sessions or use Anthropic’s own service. The reviewed evidence does not support the scanner’s exfiltration or concealed-execution claims.
Evidence
tools/unpacked
Network endpoints3
api.anthropic.comthalamus.etai.appgithub.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook runs scripts/unpack-tools.cjs, which extracts bundled platform tools.
- The Git credential helper is scoped to a session and uses the GitHub credential mechanism for github.com.
- Claude OAuth tokens are used with Anthropic’s own API endpoint.
- The package describes API-key transfer to Thalamus cloud as an explicit `thalamus connect claude` command.
Evidence against
- No source reviewed showed install-time credential collection, an unrelated credential destination, or concealed payload execution.
- The reported subprocess use is consistent with CLI launching and session-specific Git credential handling.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
21 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-BqxKDcxv.cjsView file
•context = return { rollup: UsageRollup.fromState(JSON.parse(node_fs.readFileSync(path, "utf8"))), existed: true };\n } catch (error) {\n logger.logger.warn(`[usage] unreadable rollup state ${path}, starting fresh:`, error);\n return { rollup: new UsageRollup(), existed: false };\n }\n}\nfunction saveRollup(name, rollup, dir = usageStateDir()) {\n const path = usageStatePath(name, dir);\n if (!path) return;\n const tmp = `${path}.${process.pid}.tmp`;\n try {\n node_fs.mkdirSync(dir, { recursive: true });\n node_fs.writeFileSync(tmp, JSON.stringify(rollup.toState(Date.now())));\n node_fs.renameSync(tmp, path);\n } catch (error) {\n logger.logger.warn(`[usage] could not persist rollup ${path}:`, error);\n try {\n node_fs.unlinkSync(tmp);\n } catch {\n }\
Findings
4 Critical13 High6 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-5Xt2_CY-.cjs
CriticalEncrypted Payload Temp Executiondist/api-BqxKDcxv.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-BqxKDcxv.cjs
CriticalPrevious Version Dangerous Deltadist/index-CwaL2GYu.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-BqxKDcxv.cjs
HighSame File Env Network Executiondist/api-BqxKDcxv.cjs
HighCredential Redirect Persistencedist/api-BqxKDcxv.cjs
HighCommand Output Exfiltrationdist/api-BqxKDcxv.cjs
HighSandbox Evasion Gated Capabilitydist/api-BqxKDcxv.cjs
Affected versions and remediation
This report applies to thalamus@1.5.107.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.107 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.