thalamus@1.5.50
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 28d ago · by lpm-firewall-aiInspected source does not substantiate the scanner’s alleged encrypted payload execution or a concrete attack. The clean disposition is blocked by the required nine-path citation coverage exceeding the eight-citation limit, so this remains manual review rather than a malicious finding.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation triggers the postinstall unpacker; the CLI bridge runs when its command is launched.
Impact
The observed behavior is consistent with supplying utilities for the package and supporting its CLI. No exfiltration, remote payload execution, or unconsented foreign agent control-surface mutation was established.
Mechanism
The unpacker selects local platform archives and extracts them under tools/unpacked. The inspected configuration code reads settings and derives paths; the CLI wrapper imports the package-owned bridge.
AI rationale
Inspected source does not substantiate the scanner’s alleged encrypted payload execution or a concrete attack. The clean disposition is blocked by the required nine-path citation coverage exceeding the eight-citation limit, so this remains manual review rather than a malicious finding.
Evidence
tools/unpacked
Network endpoints2
claude.ai/oauth/authorizeconsole.anthropic.com/v1/oauth/token
Decision evidence
public snapshotAI called this Manual Review at 63.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The postinstall hook invokes an unpacker that extracts platform-specific bundled utilities into the package tools directory.
- The flagged settings code derives ordinary Claude configuration and project paths; the inspected excerpts show path selection and transcript-related helpers, not installation-time configuration mutation.
- The CLI MCP wrapper imports its package-owned bridge when launched, and the OAuth endpoints shown are Claude and Anthropic endpoints.
Evidence against
- Static hints allege encrypted payload execution, but inspection found no corresponding decrypt-and-execute path in the main bundle; observed subprocesses are associated with CLI, git, platform, or daemon operations.
- The archive unpacker selects named platform archives and extracts them to tools/unpacked; no remote payload fetch or foreign agent configuration write was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
16 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-ByzLMWGL.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = thalamus@1.5.44
matchedIdentity = npm:dGhhbGFtdXM:1.5.44
similarity = 0.741
summary = stored previous version shares package body but lacks this dangerous source file
Findings
3 Critical10 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/api-ByzLMWGL.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-ByzLMWGL.cjs
HighCredential Redirect Persistencedist/index.cjs
HighCommand Output Exfiltrationdist/api-ByzLMWGL.cjs
HighCross File Remote Execution Contextdist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
Affected versions and remediation
This report applies to thalamus@1.5.50.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.50 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.