thalamus@1.5.11
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected install, bin, dependency, and Claude session-path code shows package-local binary unpacking and a runtime session lookup, not a concrete attack. A clean publication is blocked because nine required citations exceed the eight-citation cap, so the review stays unresolved.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
No attack trigger was confirmed. npm postinstall runs the unpack script, and the Claude path is used when the CLI looks up a session.
Impact
No credential theft, remote payload execution, persistence, or unconsented foreign agent-control write was shown. The remaining issue is an unresolved review constraint, not a demonstrated impact.
Mechanism
The unpack script gunzips named difftastic and ripgrep archives into tools/unpacked. The MCP launcher starts the bundled local bridge. getProjectPath reads a project session path under the Claude config directory.
AI rationale
Inspected install, bin, dependency, and Claude session-path code shows package-local binary unpacking and a runtime session lookup, not a concrete attack. A clean publication is blocked because nine required citations exceed the eight-citation cap, so the review stays unresolved.
Decision evidence
public snapshotAI called this Manual Review at 62.0% confidence as Unknown with high false-positive risk.
AI review observations
- package.json postinstall only runs node scripts/unpack-tools.cjs and there is no preinstall or install hook.
- dependencies do not include the package name thalamus, so there is no runtime self-dependency lifecycle chain.
- dist/api-BDrqy_PC.mjs getProjectPath joins CLAUDE_CONFIG_DIR or the home .claude projects directory to locate a session file; that read is not an install-time write.
- scripts/unpack-tools.cjs extracts the platform difftastic and ripgrep archives into the package tools/unpacked directory.
- bin/thalamus-mcp.mjs respawns the local dist claude MCP stdio bridge with the current Node binary and inherited stdio.
Evidence against
- The same behaviors are consistent with a Claude Code client that vendors ripgrep and difftastic and reads local Claude session files when the CLI runs.
- Marking the package clean would require nine distinct path citations, which exceeds the eight-citation limit, so a clean verdict cannot be finalized from this review.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-BDrqy_PC.mjsView file
1279L1280: const execAsync = promisify(exec$2);
L1281: function isPathWithinDirectory(targetPath, allowedDirectory) {
High
Findings
3 Critical8 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/index.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-BDrqy_PC.mjs
HighCredential Redirect Persistencedist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.cjs
HighKnown Malware Source Similaritydist/lib.mjs
Affected versions and remediation
This report applies to thalamus@1.5.11.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.