thalamus@1.5.60
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe scanner labels are not proof of malicious behavior, and the inspected excerpts do not demonstrate an active attack. Clean citation coverage is blocked by the required archive’s non-UTF-8 bytes, so unresolved package evidence prevents a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The package postinstall hook runs during installation; the inspected manifest excerpt does not show the hook’s effects.
Impact
No concrete impact is established by the inspected excerpts.
Mechanism
The inspected Claude-related excerpts identify data and settings paths, but do not show a write or unsafe configuration change.
AI rationale
The scanner labels are not proof of malicious behavior, and the inspected excerpts do not demonstrate an active attack. Clean citation coverage is blocked by the required archive’s non-UTF-8 bytes, so unresolved package evidence prevents a clean verdict.
Evidence
package.jsondist/api-BcSuP5V0.mjsdist/api-Be9iDrEz.cjsdist/index-AR8G1iLV.mjsdist/index-ClH9qg4_.cjsbin/thalamus-mcp.mjs
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json defines a postinstall script that runs scripts/unpack-tools.cjs.
- The required agent-configuration locations in the API bundles contain project and user Claude data path helpers; those excerpts do not establish a configuration mutation.
- The agent-configuration locations in both CLI bundles select policy, user, and local Claude settings files for a memory override check.
- The package includes a compressed archive that cannot be assessed through the required UTF-8 source citation mechanism.
Evidence against
- The manifest’s postinstall hook points to a package script rather than showing an agent-configuration write in the inspected excerpt.
- The inspected agent-configuration excerpts do not establish credential forwarding, remote payload execution, or an active attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
18 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-BcSuP5V0.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = thalamus@1.5.44
matchedIdentity = npm:dGhhbGFtdXM:1.5.44
similarity = 0.630
summary = stored previous version shares package body but lacks this dangerous source file
Findings
3 Critical12 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index-ClH9qg4_.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index-ClH9qg4_.cjs
CriticalPrevious Version Dangerous Deltadist/api-BcSuP5V0.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-BcSuP5V0.mjs
HighCredential Redirect Persistencedist/api-Be9iDrEz.cjs
HighCommand Output Exfiltrationdist/api-BcSuP5V0.mjs
HighCross File Remote Execution Contextdist/index-AR8G1iLV.mjs
HighTrigger Reachable Persistencedist/index-ClH9qg4_.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
Affected versions and remediation
This report applies to thalamus@1.5.60.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.60 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.