thalamus@1.5.64
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe flagged executable excerpts inspected do not establish the reported payload execution or agent control hijack. The required compressed archive remains unverified, so the source review cannot support a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation triggers the postinstall script; the MCP wrapper runs when its command is invoked.
Impact
The available source does not establish malicious impact; the unresolved archive prevents a clean determination.
Mechanism
The inspected postinstall excerpt begins platform tool extraction. The reviewed executable excerpts show Claude log handling, alert decryption, and bridge process management.
AI rationale
The flagged executable excerpts inspected do not establish the reported payload execution or agent control hijack. The required compressed archive remains unverified, so the source review cannot support a clean verdict.
Evidence
package.jsonscripts/unpack-tools.cjsdist/api-Crd88dHb.cjsdist/api-DdCE39Yp.mjsdist/index-BR0f0M5t.mjsdist/index-rKjW2waw.cjsbin/thalamus-mcp.mjstools/archives/difftastic-arm64-linux.tar.gz
Decision evidence
public snapshotAI called this Manual Review at 64.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The automatic postinstall runs scripts/unpack-tools.cjs to unpack platform tools.
- The four agent-integration excerpts resolve to Claude project log paths and log-directory creation; they do not establish a control-surface mutation.
- The flagged decryption excerpt handles application alert data, with no payload execution shown there.
- The MCP wrapper spawns the package's bridge and forwards process signals.
- The required compressed archive is binary and cannot be verified through the available source citation mechanism.
Evidence against
- The inspected source excerpts do not establish the scanner-reported encrypted-payload execution behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
18 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-DdCE39Yp.mjsView file
1762L1763: const execAsync = promisify(exec$2);
L1764: const pathModule = path__default;
High
Shell
Findings
3 Critical12 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index-rKjW2waw.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index-rKjW2waw.cjs
CriticalPrevious Version Dangerous Deltadist/index-rKjW2waw.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-DdCE39Yp.mjs
HighSame File Env Network Executiondist/api-DdCE39Yp.mjs
HighCredential Redirect Persistencedist/api-Crd88dHb.cjs
HighCommand Output Exfiltrationdist/api-DdCE39Yp.mjs
HighCross File Remote Execution Contextdist/index-BR0f0M5t.mjs
HighTrigger Reachable Persistencedist/index-rKjW2waw.cjs
Affected versions and remediation
This report applies to thalamus@1.5.64.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.64 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.