thalamus@1.5.67
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 24d ago · by lpm-firewall-aiInspected lifecycle and flagged source show package-local tool extraction and local transcript or metrics handling, without a confirmed attack chain. The archive is non-source binary data and required clean citation coverage cannot be completed, so the unresolved binary prevents a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation triggers the postinstall unpacker.
Impact
No malicious effect was established from the inspected source; the archive remains unverified.
Mechanism
The hook selects a platform archive and extracts tools into the package’s tools directory.
AI rationale
Inspected lifecycle and flagged source show package-local tool extraction and local transcript or metrics handling, without a confirmed attack chain. The archive is non-source binary data and required clean citation coverage cannot be completed, so the unresolved binary prevents a clean verdict.
Evidence
tools/archives/difftastic-arm64-linux.tar.gztools/unpacked
Decision evidence
public snapshotAI called this Manual Review at 77.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The install hook runs a package-local tool unpacker; the unpacker identifies its purpose as extracting platform-specific binaries.
- The flagged API locations derive Claude project transcript paths and parse local transcript text.
- The flagged index locations compute friction metrics from local Claude project data and write state and metrics files.
- The MCP wrapper starts the package’s own bridge with inherited standard streams and forwards termination signals.
- The shipped library and index entrypoints load package-local API and index modules.
Evidence against
- The supplied archive is a binary and could not be evaluated through source citations; its presence alone does not establish malicious behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
18 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index-DpBHRP0U.cjsView file
•context = ] ?? 0;\n if (va > vb) return 1;\n if (va < vb) return -1;\n }\n return 0;\n}\nfunction isCacheUsable(cached, currentVersion, now) {\n if (!cached) return false;\n if (now - cached.checkedAt >= CACHE_TTL_MS) return false;\n if (compareSemver(currentVersion, cached.latestVersion) > 0) return false;\n return true;\n}\nfunction readCache() {\n try {\n const raw = node_fs.readFileSync(CACHE_FILE, "utf-8");\n return JSON.parse(raw);\n } catch {\n return null;\n }\n}\nfunction writeCache(cache) {\n try {\n node_fs.writeFileSync(CACHE_FILE, JSON.stringify(cache), "utf-8");\n } catch {\n }\n}\nasync function fetchLatestVersion() {\n try {\n const response = await axios.get(\n `https://registry.npmjs.org/${NPM_PACKAGE_NAME}/latest`,\n { timeout:
Findings
3 Critical12 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index-DpBHRP0U.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index-DpBHRP0U.cjs
CriticalPrevious Version Dangerous Deltadist/api-22Ms2u-X.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index-DpBHRP0U.cjs
HighCredential Redirect Persistencedist/api-DhGX5OTp.cjs
HighSandbox Evasion Gated Capabilitydist/index-DpBHRP0U.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/api-DhGX5OTp.cjs
HighCross File Remote Execution Contextdist/index-C3kDiHxK.mjs
HighTrigger Reachable Persistence
Affected versions and remediation
This report applies to thalamus@1.5.67.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.67 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.