thalamus@1.5.70
Mobile and Web client for Claude Code
AI Security Review
scanned 22d ago · by lpm-firewall-aiSource inspection confirms conditional runtime setup of a first-party Claude plugin, which falls under the warning policy for package-owned agent extension setup. The flagged transcript and metrics locations are benign; the package's postinstall hook instead extracts platform tool archives.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Runtime startup of a session whose configuration enables workflow skills and whose Claude executable supports plugin directories.
Impact
Claude loads the package's workflow skills for the session; the behavior changes the agent extension surface.
Mechanism
The runtime writes plugin metadata and bundled skill files under plugins/workflows, then passes that directory using Claude's plugin-dir argument.
AI rationale
Source inspection confirms conditional runtime setup of a first-party Claude plugin, which falls under the warning policy for package-owned agent extension setup. The flagged transcript and metrics locations are benign; the package's postinstall hook instead extracts platform tool archives.
Evidence
dist/api-rm3KQJuZ.cjsplugins/workflows/<hash> under the configured Thalamus home directory
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The flagged locations resolve to Claude project transcript handling and friction-metric output, not agent configuration changes.
- During session startup, supported Claude sessions can receive the bundled workflow plugin directory.
- The runtime writes plugin metadata and skill files under the configured Thalamus home directory, then supplies the directory through Claude's plugin-dir argument.
- The postinstall hook invokes a helper that extracts platform tool archives.
Evidence against
- The plugin setup is gated by session configuration and Claude's plugin-dir support; the plugin contains package-bundled workflow skills.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
18 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-Q6AgJ46H.mjsView file
1001L1002: const execAsync = promisify(exec$2);
L1003: const pathModule = path__default;
High
Shell
Findings
3 Critical12 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/api-rm3KQJuZ.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-rm3KQJuZ.cjs
CriticalPrevious Version Dangerous Deltadist/api-rm3KQJuZ.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-Q6AgJ46H.mjs
HighSame File Env Network Executiondist/api-Q6AgJ46H.mjs
HighCredential Redirect Persistencedist/api-rm3KQJuZ.cjs
HighCommand Output Exfiltrationdist/api-Q6AgJ46H.mjs
HighSandbox Evasion Gated Capabilitydist/api-Q6AgJ46H.mjs
HighCross File Remote Execution Contextdist/api-Q6AgJ46H.mjs
Affected versions and remediation
This report applies to thalamus@1.5.70.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.70 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.