thalamus@1.5.68
Mobile and Web client for Claude Code
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe source confirms guarded setup of a package-owned Claude skill plugin, which warrants a warning under the agent integration policy. The inspected lifecycle hook only unpacks package-local platform tools, and the flagged project-path references serve metrics collection; neither establishes a malicious attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting a Thalamus session whose type enables workflow skills with a Claude executable that supports plugin directories.
Impact
Claude can load the package’s bundled workflow skills for that session.
Mechanism
The package writes a plugin manifest and bundled skill files under the Thalamus home directory, then adds that directory to Claude’s launch arguments.
AI rationale
The source confirms guarded setup of a package-owned Claude skill plugin, which warrants a warning under the agent integration policy. The inspected lifecycle hook only unpacks package-local platform tools, and the flagged project-path references serve metrics collection; neither establishes a malicious attack.
Evidence
dist/api-CKgmr3qG.mjspackage.jsonscripts/unpack-tools.cjsdist/api-CLb0YXOF.cjsdist/index-6AZxtwJI.cjsdist/index-Br7hJqHX.mjs
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The flagged paths in both module formats resolve project directories under Claude’s configuration folder.
- The package can write bundled skill files and plugin metadata under its Thalamus plugin directory.
- The plugin directory is included in Claude launch arguments only when workflow skills are enabled and Claude supports plugin directories.
- Installation runs a postinstall tool extractor that selects platform archives and unpacks them into the package tools directory.
Evidence against
- The flagged index code reads Claude project logs to compute friction metrics and writes resulting metrics to Thalamus state.
- The plugin materialization path is gated by workflow-skill configuration and Claude plugin-directory support.
- The inspected postinstall extractor uses package-local platform archives and skips extraction when its unpacked directory is a symlink.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
18 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index-Br7hJqHX.mjsView file
9211}
L9212: function powershellPath() {
L9213: return join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
Findings
3 Critical12 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index-6AZxtwJI.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index-6AZxtwJI.cjs
CriticalPrevious Version Dangerous Deltadist/api-CKgmr3qG.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index-Br7hJqHX.mjs
HighCredential Redirect Persistencedist/api-CLb0YXOF.cjs
HighSandbox Evasion Gated Capabilitydist/index-6AZxtwJI.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/api-CLb0YXOF.cjs
HighCross File Remote Execution Contextdist/index-6AZxtwJI.cjs
HighTrigger Reachable Persistence
Affected versions and remediation
This report applies to thalamus@1.5.68.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.68 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.