thalamus@1.5.44
Mobile and Web client for Claude Code
AI Security Review
scanned 29d ago · by lpm-firewall-aiThe source supports a warning for guarded, package-owned Claude plugin setup during configured sessions. The postinstall is limited to unpacking bundled tools, and the scanner’s decrypt-and-execute claim was not supported by the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting a local Claude session whose type enables workflow skills on a Claude version that supports plugin directories.
Impact
The bundled skills become available to Claude during the session.
Mechanism
The package materializes bundled skill files and passes their plugin directory to Claude for that session.
AI rationale
The source supports a warning for guarded, package-owned Claude plugin setup during configured sessions. The postinstall is limited to unpacking bundled tools, and the scanner’s decrypt-and-execute claim was not supported by the inspected source.
Evidence
dist/api-BmgZrt6W.cjs
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The npm postinstall runs a tool-unpacking script that extracts bundled difftastic and ripgrep archives.
- Workflow skills are materialized as a package-owned Claude plugin under Thalamus’s home directory.
- A local Claude session adds that plugin directory when its session type enables workflow skills and Claude supports the plugin option.
Evidence against
- The inspected postinstall extracts platform tools; the reviewed source did not substantiate the scanner’s decrypt-and-execute claim.
- The Claude plugin setup is guarded by session configuration and is separate from npm installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
16 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-CcYk2_X9.mjsView file
1639L1640: const execAsync = promisify(exec$2);
L1641: const pathModule = path__default;
High
Shell
Findings
3 Critical10 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/api-BmgZrt6W.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-CcYk2_X9.mjs
HighCredential Redirect Persistencedist/index.cjs
HighCommand Output Exfiltrationdist/index.cjs
HighCross File Remote Execution Contextdist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
Affected versions and remediation
This report applies to thalamus@1.5.44.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.44 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.