thalamus@1.5.52
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 18d ago · by lpm-firewall-aiStatic inspection did not verify malicious behavior in the flagged agent-related code or the managed MCP installer. The postinstall extracts an executable archive whose contents could not be verified, leaving a material question unresolved; manual review is appropriate.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm postinstall invokes scripts/unpack-tools.cjs.
Impact
The archive's contents and any behavior of its extracted files cannot be confirmed from the inspected source.
Mechanism
The script extracts a platform-specific archive and applies executable permissions to extracted files; the archive analysis file was unavailable to inspect.
AI rationale
Static inspection did not verify malicious behavior in the flagged agent-related code or the managed MCP installer. The postinstall extracts an executable archive whose contents could not be verified, leaving a material question unresolved; manual review is appropriate.
Evidence
scripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gz
Decision evidence
public snapshotAI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs scripts/unpack-tools.cjs during postinstall.
- The installer extracts the platform-specific difftastic archive and makes extracted files executable; the archive contents could not be verified in this inspection.
- The flagged agent-related locations read Claude settings paths or derive a project transcript path; these excerpts do not establish agent-control mutation.
- The managed MCP installer disables dependency lifecycle scripts when it invokes npm.
Evidence against
- The archive is selected by platform and unpacked as a tool asset; the inspected caller does not execute its contents during extraction.
- MCP server launch configuration is loaded from the organization registry, and only enabled entries are used.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
16 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-Cy1-pTkc.mjsView file
1698L1699: const execAsync = promisify(exec$2);
L1700: const pathModule = path__default;
High
Shell
Findings
3 Critical10 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/api-B4SNNHr0.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-Cy1-pTkc.mjs
HighCredential Redirect Persistencedist/index.cjs
HighCommand Output Exfiltrationdist/api-Cy1-pTkc.mjs
HighCross File Remote Execution Contextdist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
Affected versions and remediation
This report applies to thalamus@1.5.52.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.52 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.