thalamus@1.5.61
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe inspected agent-related excerpts do not establish a malicious action, and the postinstall script shows local archive extraction. The required archive is non-UTF-8 and cannot be assessed from source; this unresolved required artifact prevents a clean decision, while the inspected source does not independently establish a warning or attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation triggers the package postinstall hook.
Impact
The archive contents remain unresolved, so static source inspection cannot establish whether the extracted binaries are benign or harmful.
Mechanism
The hook selects a platform-specific archive and extracts it into the package tools directory.
AI rationale
The inspected agent-related excerpts do not establish a malicious action, and the postinstall script shows local archive extraction. The required archive is non-UTF-8 and cannot be assessed from source; this unresolved required artifact prevents a clean decision, while the inspected source does not independently establish a warning or attack.
Evidence
package.jsonscripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gz
Decision evidence
public snapshotAI called this Manual Review at 63.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package has a postinstall hook that runs a local tool-unpacking script; the inspected script selects a platform archive and extracts it into the package tools directory.
- The named agent configuration locations inspect Claude settings and project paths; the inspected excerpts do not establish a configuration write or plugin installation.
- The MCP launcher starts its package-local bridge and forwards arguments and environment to it.
- A required compressed archive is non-UTF-8 and cannot be assessed through source citations; static inspection does not establish what it contains.
Evidence against
- The postinstall script’s shown behavior extracts platform-specific archives shipped with the package rather than fetching a remote payload.
- The inspected agent-configuration excerpts show path selection and memory-override checks, not agent-control mutation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
19 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-B1MgKVMU.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = thalamus@1.5.44
matchedIdentity = npm:dGhhbGFtdXM:1.5.44
similarity = 0.593
summary = stored previous version shares package body but lacks this dangerous source file
Findings
3 Critical13 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index-Bet5H4KK.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index-Bet5H4KK.cjs
CriticalPrevious Version Dangerous Deltadist/api-B1MgKVMU.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-B1MgKVMU.cjs
HighSame File Env Network Executiondist/index-Bet5H4KK.cjs
HighCredential Redirect Persistencedist/api-B1MgKVMU.cjs
HighCommand Output Exfiltrationdist/api-B1MgKVMU.cjs
HighCross File Remote Execution Contextdist/index-9O4qOE3N.mjs
HighTrigger Reachable Persistencedist/index-Bet5H4KK.cjs
Affected versions and remediation
This report applies to thalamus@1.5.61.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.61 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.