thalamus@1.5.16
Mobile and Web client for Claude Code
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source supports a concrete remote agent-permission escalation capability, but not malicious installation behavior, credential theft, or an unauthorized control-channel takeover. It warrants a warning because compromise or misuse of the remote session channel could materially reduce agent approval safeguards.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A connected remote client sends a mode-change RPC requesting bypass-permissions mode.
Impact
A party able to control the connected remote session could expand the agent's tool permissions without individual tool approvals.
Mechanism
The RPC handler applies the requested mode; pending tool calls can then be approved automatically, and the process may be respawned in bypass mode.
AI rationale
The source supports a concrete remote agent-permission escalation capability, but not malicious installation behavior, credential theft, or an unauthorized control-channel takeover. It warrants a warning because compromise or misuse of the remote session channel could materially reduce agent approval safeguards.
Evidence
dist/api-CFtDmp6A.mjs
Network endpoints1
thalamus.etai.app
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The session RPC accepts a remote request to change the Claude permission mode, including bypass-permissions mode.
- A bypass-permissions mode change automatically approves pending tools other than the excluded set.
- If a live bypass mode change is refused, the code requests a respawn in that mode.
Evidence against
- The install hook only invokes a local script that unpacks bundled platform tools.
- No evidence found of automatic modification of Claude configuration files or of credential export to an unrelated endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-BxopKpsk.cjsView file
1382L1383: const execAsync = util.promisify(child_process.exec);
L1384: function isPathWithinDirectory(targetPath, allowedDirectory) {
High
Findings
3 Critical8 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/index.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-BxopKpsk.cjs
HighCredential Redirect Persistencedist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.cjs
HighKnown Malware Source Similaritydist/lib.mjs
Affected versions and remediation
This report applies to thalamus@1.5.16.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.