thalamus@1.5.18
Mobile and Web client for Claude Code
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected install behavior stays within package tool setup, and the flagged agent paths support session lookup rather than configuration mutation. Runtime process control and authentication flows align with the client functionality, with no concrete malicious chain identified.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installation extracts packaged tools; invoking the CLI activates session and daemon functionality.
Impact
No credential theft or unconsented install-time agent control mutation was identified.
Mechanism
The package launches its own bridge, reads session records, and sends Claude OAuth tokens to the fixed Anthropic usage endpoint. No malicious mechanism was established.
AI rationale
Inspected install behavior stays within package tool setup, and the flagged agent paths support session lookup rather than configuration mutation. Runtime process control and authentication flows align with the client functionality, with no concrete malicious chain identified.
Network endpoints2
api.anthropic.com/api/oauth/usagethalamus.etai.app
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook extracts bundled platform tools into the package tools directory; no runtime self-dependency is declared.
- Both flagged API locations resolve Claude project session paths for session checks, without modifying agent configuration.
- The MCP launcher starts the package bridge and forwards caller arguments and termination signals.
- The CLI supplies its own MCP bridge through session launch arguments; watchdog installation is an explicit command.
- The inspected difftastic archive contains a difft executable and is unpacked as a local comparison tool.
- Both library entrypoints expose API clients and configuration from the inspected API bundles.
Evidence against
- Bundled native executable internals were not fully analyzed; the CLI supports remote session control as part of its functionality.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-uu9tGcaO.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = thalamus@1.5.17
matchedIdentity = npm:dGhhbGFtdXM:1.5.17
similarity = 0.737
summary = stored previous version shares package body but lacks this dangerous source file
Findings
3 Critical8 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/api-uu9tGcaO.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-uu9tGcaO.cjs
HighCredential Redirect Persistencedist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.cjs
HighKnown Malware Source Similaritydist/lib.mjs
Affected versions and remediation
This report applies to thalamus@1.5.18.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.