thalamus@1.5.66
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe inspected source locations do not substantiate the scanner’s alleged encrypted-payload execution or agent-control mutation. The shipped binary archive cannot be cleared through source inspection, so the package remains unresolved.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The package postinstall hook runs during installation and unpacks a platform-specific archive.
Impact
No attack impact was confirmed; the unverified archive prevents a clean determination.
Mechanism
The inspected hook extracts bundled tools; the inspected flagged code reads Claude project transcripts or writes friction metrics. The archive contents could not be verified as source.
AI rationale
The inspected source locations do not substantiate the scanner’s alleged encrypted-payload execution or agent-control mutation. The shipped binary archive cannot be cleared through source inspection, so the package remains unresolved.
Evidence
scripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gz
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The install hook is a platform-specific tool unpacker; the inspected code extracts a packaged archive into the package tools directory.
- The flagged API locations read Claude project transcript files, and the flagged index locations compute and write friction metrics.
- The package also ships a compressed binary archive whose contents cannot be verified with source citations.
Evidence against
- The inspected agent-related code reads Claude project data or writes metrics under the package’s configured data directory; these excerpts do not establish an agent-control mutation.
- The package manifest identifies the product as a Claude Code client and registers a postinstall tool unpacker.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
20 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-wsPVrwOM.mjsView file
1763L1764: const execAsync = promisify(exec$2);
L1765: const pathModule = path__default;
High
Shell
Findings
3 Critical14 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index-CbXudDBB.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index-CbXudDBB.cjs
CriticalPrevious Version Dangerous Deltadist/api-Bigyup-9.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-wsPVrwOM.mjs
HighSame File Env Network Executiondist/api-wsPVrwOM.mjs
HighCredential Redirect Persistencedist/api-Bigyup-9.cjs
HighCommand Output Exfiltrationdist/api-wsPVrwOM.mjs
HighSandbox Evasion Gated Capabilitydist/index-CbXudDBB.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutation
Affected versions and remediation
This report applies to thalamus@1.5.66.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.66 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.