thalamus@1.5.59
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe flagged agent-related source excerpts show Claude transcript and memory-setting inspection, not an agent configuration mutation. The postinstall hook extracts an opaque binary archive; because its contents cannot be verified and clean citation coverage is unavailable for that binary, the package requires manual review.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation triggers the postinstall script.
Impact
The archive’s behavior cannot be determined from the inspected source, so malicious execution is neither established nor ruled out.
Mechanism
The script extracts the platform-specific tools archive into tools/unpacked and sets executable permissions on extracted files.
AI rationale
The flagged agent-related source excerpts show Claude transcript and memory-setting inspection, not an agent configuration mutation. The postinstall hook extracts an opaque binary archive; because its contents cannot be verified and clean citation coverage is unavailable for that binary, the package requires manual review.
Evidence
scripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gztools/unpacked
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The four flagged locations concern Claude project transcript paths or read Claude memory settings; the inspected excerpts show no agent configuration write.
- The manifest runs a postinstall script that unpacks bundled platform tools.
- The unpacker extracts an archive into tools/unpacked; the archive’s executable contents could not be assessed from source.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
18 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-Cq3V4oM0.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = thalamus@1.5.44
matchedIdentity = npm:dGhhbGFtdXM:1.5.44
similarity = 0.630
summary = stored previous version shares package body but lacks this dangerous source file
Findings
3 Critical12 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index-CcNr7SWu.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index-CcNr7SWu.cjs
CriticalPrevious Version Dangerous Deltadist/api-Cq3V4oM0.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-Cq3V4oM0.cjs
HighCredential Redirect Persistencedist/api-Cq3V4oM0.cjs
HighCommand Output Exfiltrationdist/api-Cq3V4oM0.cjs
HighCross File Remote Execution Contextdist/index-CcNr7SWu.cjs
HighTrigger Reachable Persistencedist/index-CcNr7SWu.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
Affected versions and remediation
This report applies to thalamus@1.5.59.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.59 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.