thalamus@1.5.69
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe inspected postinstall path performs platform tool extraction, and the apparent decryption match does not establish the scanner's claimed execution chain. Required flagged files, including a binary archive and additional bundles, remain unresolved, so the source review cannot support either a clean or malicious conclusion.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The package postinstall hook runs during installation; the MCP bridge launches when its command is invoked.
Impact
Inspected behavior supports tool setup and bridge startup; the unresolved files prevent a clean determination.
Mechanism
The postinstall script unpacks platform-specific tools. The bundle excerpt shows authenticated decryption, without evidence here of writing or executing a decrypted payload.
AI rationale
The inspected postinstall path performs platform tool extraction, and the apparent decryption match does not establish the scanner's claimed execution chain. Required flagged files, including a binary archive and additional bundles, remain unresolved, so the source review cannot support either a clean or malicious conclusion.
Evidence
tools/unpacked
Decision evidence
public snapshotAI called this Manual Review at 63.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs a postinstall script that unpacks bundled tools.
- The unpacker selects platform-specific archives and extracts them into tools/unpacked.
- The flagged bundle contains AES-GCM decryption, but the inspected excerpt does not establish a malicious payload or execution chain.
Evidence against
- The MCP launcher starts its declared bridge entrypoint and forwards the current arguments and environment.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
17 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index-CNZry_X9.mjsView file
9211}
L9212: function powershellPath() {
L9213: return join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
Findings
2 Critical12 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index-Bx6gFMdE.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index-Bx6gFMdE.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index-CNZry_X9.mjs
HighCredential Redirect Persistencedist/api-BzxDdcJ0.cjs
HighSandbox Evasion Gated Capabilitydist/index-Bx6gFMdE.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/api-BzxDdcJ0.cjs
HighCross File Remote Execution Contextdist/index-Bx6gFMdE.cjs
HighTrigger Reachable Persistencedist/index-Bx6gFMdE.cjs
HighShips High Entropy Blob
Affected versions and remediation
This report applies to thalamus@1.5.69.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.69 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.