thalamus@1.5.20
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected agent paths and their callers support session transcript handling rather than install-time agent control hijacking. The required archive is binary and its executable behavior remains unverified, so the available source evidence supports neither a complete clean finding nor a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installation extracts platform tools; a runtime diff request launches the extracted executable.
Impact
No malicious impact was established. The remaining uncertainty concerns the behavior of the bundled executable.
Mechanism
The package extracts a local archive and spawns its executable; the binary's internal behavior could not be established from readable source.
AI rationale
The inspected agent paths and their callers support session transcript handling rather than install-time agent control hijacking. The required archive is binary and its executable behavior remains unverified, so the available source evidence supports neither a complete clean finding nor a malicious verdict.
Evidence
scripts/unpack-tools.cjsdist/api-BLVgsCJ4.cjstools/archives/difftastic-arm64-linux.tar.gz
Decision evidence
public snapshotAI called this Manual Review at 90.0% confidence as Unknown with high false-positive risk.
AI review observations
- The postinstall hook invokes a local archive extractor, including extraction of the platform-specific difftastic archive.
- The runtime launches the extracted difft executable. The required Linux archive contains a binary executable whose behavior was not established by source inspection.
- Both flagged agent integration locations resolve Claude project transcript directories; inspected callers check, read, or scan session files.
- The CLI supplies session MCP configuration pointing to its bundled launcher, which forwards arguments to the bridge.
Evidence against
- No concrete malicious install mutation, covert credential forwarding, or remote payload execution was established in the inspected source.
- The diff request handler restricts working directories and file arguments to the session scope.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-BLVgsCJ4.cjsView file
1420L1421: const execAsync = util.promisify(child_process.exec);
L1422: function isPathWithinDirectory(targetPath, allowedDirectory) {
High
Findings
3 Critical8 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/index.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-BLVgsCJ4.cjs
HighCredential Redirect Persistencedist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.cjs
HighKnown Malware Source Similaritydist/lib.mjs
Affected versions and remediation
This report applies to thalamus@1.5.20.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.