thalamus@1.5.63
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe inspected bundle findings did not establish the scanner’s claimed encrypted-payload execution or agent-control modification. Because the required compressed archive is binary and could not be assessed, the package remains unresolved and requires manual review.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation triggers the postinstall unpacker.
Impact
The archive contents remain unresolved, preventing a clean determination; no active payload execution was established.
Mechanism
The unpacker extracts platform-specific archives into the package’s tools directory and marks extracted files executable.
AI rationale
The inspected bundle findings did not establish the scanner’s claimed encrypted-payload execution or agent-control modification. Because the required compressed archive is binary and could not be assessed, the package remains unresolved and requires manual review.
Evidence
tools/unpacked
Decision evidence
public snapshotAI called this Manual Review at 66.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package postinstall runs a tool unpacker that extracts bundled platform archives into the package tools directory.
- The flagged agent-configuration locations handle Claude project paths and write local friction metrics; the inspected excerpts show no agent-control configuration change.
- The encrypted-data finding is ordinary alert decryption code, not evidence of decrypting and executing a hidden payload.
- The MCP binary entrypoint spawns its declared bridge process while forwarding arguments and environment.
Evidence against
- The compressed difftastic archive is binary and could not be assessed from source citations; its contents remain unresolved.
- The archive extraction uses bundled files during postinstall, so static inspection of the script alone cannot establish the archive’s contents.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
18 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index-Cn1pFU_A.mjsView file
6926}
L6927: function powershellPath() {
L6928: return join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
Findings
3 Critical12 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index-CJ-UqFOW.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index-CJ-UqFOW.cjs
CriticalPrevious Version Dangerous Deltadist/index-CJ-UqFOW.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index-Cn1pFU_A.mjs
HighSame File Env Network Executiondist/api-t21sYDlV.mjs
HighCredential Redirect Persistencedist/api-kIQshIQ0.cjs
HighCommand Output Exfiltrationdist/api-t21sYDlV.mjs
HighCross File Remote Execution Contextdist/index-CJ-UqFOW.cjs
HighTrigger Reachable Persistencedist/index-CJ-UqFOW.cjs
Affected versions and remediation
This report applies to thalamus@1.5.63.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.63 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.