thalamus@1.5.46
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 29d ago · by lpm-firewall-aiThe inspected source shows a local archive extraction hook and benign Claude transcript path handling, but the flagged binary archive could not be examined. Manual review is appropriate to resolve its contents; the available evidence does not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The archive is handled during npm postinstall.
Impact
The archive’s contents and any behavior of its binaries remain unknown.
Mechanism
The postinstall script selects the current platform archive and extracts it into tools/unpacked; the archive contents could not be verified.
AI rationale
The inspected source shows a local archive extraction hook and benign Claude transcript path handling, but the flagged binary archive could not be examined. Manual review is appropriate to resolve its contents; the available evidence does not establish malicious behavior.
Evidence
tools/archives/difftastic-arm64-linux.tar.gztools/unpacked
Decision evidence
public snapshotAI called this Manual Review at 73.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The postinstall hook runs a local script that extracts bundled platform tools into the package’s tools directory.
- The agent-configuration hint resolves to code that constructs a Claude project transcript path and reads that transcript.
- The bundled archive is binary and could not be inspected through the available source reader, leaving its contents unresolved.
Evidence against
- The inspected postinstall code extracts a named platform archive into tools/unpacked; it shows no network request or execution of the extracted files.
- The MCP launcher starts the package’s own bridge entrypoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
16 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index.cjsView file
•context = ] ?? 0;\n if (va > vb) return 1;\n if (va < vb) return -1;\n }\n return 0;\n}\nfunction isCacheUsable(cached, currentVersion, now) {\n if (!cached) return false;\n if (now - cached.checkedAt >= CACHE_TTL_MS) return false;\n if (compareSemver(currentVersion, cached.latestVersion) > 0) return false;\n return true;\n}\nfunction readCache() {\n try {\n const raw = node_fs.readFileSync(CACHE_FILE, "utf-8");\n return JSON.parse(raw);\n } catch {\n return null;\n }\n}\nfunction writeCache(cache) {\n try {\n node_fs.writeFileSync(CACHE_FILE, JSON.stringify(cache), "utf-8");\n } catch {\n }\n}\nasync function fetchLatestVersion() {\n try {\n const response = await axios.get(\n `https://registry.npmjs.org/${NPM_PACKAGE_NAME}/latest`,\n { timeout:
Findings
3 Critical10 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/api-N4g00LFm.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index.cjs
HighCredential Redirect Persistencedist/index.cjs
HighCommand Output Exfiltrationdist/index.cjs
HighCross File Remote Execution Contextdist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
Affected versions and remediation
This report applies to thalamus@1.5.46.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.46 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.