thalamus@1.5.13
Mobile and Web client for Claude Code
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a real conditional data-disclosure capability to an unrestricted endpoint, not evidence of default malware behavior. The agent-target code inspected reads session data and does not establish configuration mutation.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A process runs with both remote-logging environment variables set.
Impact
Sensitive values present in logs could be disclosed to the configured recipient.
Mechanism
The logger serializes messages and arguments into an HTTP POST to the configured URL.
AI rationale
This is a real conditional data-disclosure capability to an unrestricted endpoint, not evidence of default malware behavior. The agent-target code inspected reads session data and does not establish configuration mutation.
Evidence
dist/api-CJfIIfMB.cjs
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Remote logging is enabled only when two environment variables are set.
- The logger serializes messages and arguments and posts them to the environment-selected server URL.
- The inspected agent-related module reads Claude project session files rather than changing agent configuration.
- The install hook invokes a local archive unpacking script.
Evidence against
- The remote logging switch is explicit rather than enabled by default.
- No automatic write to Claude configuration was found in either inspected agent target.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
13 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/lib.cjsView file
•matchType = token_shingles
matchedPackage = claudeputer@1.1.41
matchedPath = dist/lib.cjs
matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
Findings
3 Critical8 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/index.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShell
HighCredential Redirect Persistencedist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.cjs
HighKnown Malware Source Similaritydist/lib.mjs
MediumDynamic Require
Affected versions and remediation
This report applies to thalamus@1.5.13.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.