thalamus@1.5.17
Mobile and Web client for Claude Code
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe remotely managed agent path is a dangerous capability that warrants a warning because server configuration can alter Claude session behavior. Static inspection did not establish malware intent or a concrete install-time compromise.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting a connected Thalamus session with remotely supplied managed agents.
Impact
A service-side configuration can influence the capabilities and behavior available to Claude sessions.
Mechanism
The client fetches authenticated server configuration and forwards managed agents through Claude launch options.
AI rationale
The remotely managed agent path is a dangerous capability that warrants a warning because server configuration can alter Claude session behavior. Static inspection did not establish malware intent or a concrete install-time compromise.
Evidence
dist/api-DImCc0Z5.cjsdist/api-qiU-o7bg.mjs
Network endpoints1
thalamus.etai.app
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The client fetches managed configuration from its server when connecting, authenticated with its service token.
- Both bundled variants pass nonempty remotely managed agent definitions to Claude through the agents option.
- An optional environment-controlled remote logging path posts log content to the configured server URL.
- The install hook only invokes the packaged tool-unpacking script.
Evidence against
- No source evidence showed an install-time write to Claude configuration or another broad agent control surface.
- No automatic self-dependency chain or hidden payload download was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-DImCc0Z5.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = thalamus@1.5.16
matchedIdentity = npm:dGhhbGFtdXM:1.5.16
similarity = 0.842
summary = stored previous version shares package body but lacks this dangerous source file
Findings
3 Critical8 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/api-DImCc0Z5.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-DImCc0Z5.cjs
HighCredential Redirect Persistencedist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.cjs
HighKnown Malware Source Similaritydist/lib.mjs
Affected versions and remediation
This report applies to thalamus@1.5.17.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.