thalamus@1.5.108
Mobile and Web client for Claude Code
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged install behavior extracts bundled tools locally. The credential transfer is reached through an explicit connect command and an Anthropic OAuth flow, consistent with the package's stated cloud connection feature.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review
Trigger
Installation unpacks tools; credential registration occurs when the user runs thalamus connect claude.
Impact
No automatic credential theft or unrelated execution was identified. The explicit connect flow stores credentials with the user's Thalamus account.
Mechanism
The install script extracts bundled archives into tools/unpacked. The connect flow obtains Anthropic OAuth tokens and posts them to the configured Thalamus server.
AI rationale
The flagged install behavior extracts bundled tools locally. The credential transfer is reached through an explicit connect command and an Anthropic OAuth flow, consistent with the package's stated cloud connection feature.
Evidence
tools/unpacked
Network endpoints2
api.anthropic.com/api/oauth/profile${logger.configuration.serverUrl}/v1/connect/${vendor}/register
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook calls scripts/unpack-tools.cjs.
- The unpacker extracts bundled platform archives into tools/unpacked.
- Anthropic OAuth tokens are sent to the configured Thalamus server only through the explicit connect command.
- Claude OAuth profile tokens are sent to api.anthropic.com/api/oauth/profile.
Evidence against
- Installation runs a postinstall script that writes extracted binaries.
- The connect command transfers Anthropic OAuth tokens to Thalamus cloud after the user starts the command and completes OAuth.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
21 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index-CMZbUQu6.cjsView file
9var persistence = require('./persistence-DIDBixFL.cjs');
L10: var child_process = require('child_process');
L11: var psList = require('ps-list');
...
L14: var path = require('node:path');
L15: var axios = require('axios');
L16: var fs$2 = require('fs/promises');
...
L104: }
L105: const body = await res.json().catch(() => null);
L106: if (res.status === 404) return body?.error === "Not found" ? { kind: "not-found" } : { kind: "retry" };
...
L556: }
L557: if (process.platform !== "darwin") {
L558: logger.logger.debug("[caffeinate] Not on macOS, skipping caffeinate");
Findings
4 Critical13 High6 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-CMZbUQu6.cjs
CriticalEncrypted Payload Temp Executiondist/index-CMZbUQu6.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-CwVbqlyk.cjs
CriticalPrevious Version Dangerous Deltadist/index-CMZbUQu6.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index-CMZbUQu6.cjs
HighSame File Env Network Executiondist/api-CwVbqlyk.cjs
HighCredential Redirect Persistencedist/api-CwVbqlyk.cjs
HighCommand Output Exfiltrationdist/api-CwVbqlyk.cjs
HighSandbox Evasion Gated Capabilitydist/index-CMZbUQu6.cjs
Affected versions and remediation
This report applies to thalamus@1.5.108.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.108 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.