thalamus@1.5.71
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe flagged agent-related locations concern local friction metrics and transcript reading, and no concrete attack was identified there. The postinstall unpacker uses platform archives whose contents remain unresolved, so a clean verdict is not supported.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review
Trigger
Package installation triggers the postinstall script.
Impact
The behavior appears consistent with installing local tools, but the unresolved archive contents prevent excluding hidden executable behavior.
Mechanism
The script extracts platform-specific difftastic and ripgrep archives into tools/unpacked and sets executable permissions on extracted files on Unix systems.
AI rationale
The flagged agent-related locations concern local friction metrics and transcript reading, and no concrete attack was identified there. The postinstall unpacker uses platform archives whose contents remain unresolved, so a clean verdict is not supported.
Evidence
package.jsonscripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gztools/unpackedtools/archives/ripgrep-arm64-linux.tar.gz
Decision evidence
public snapshotAI called this Manual Review at 85.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs scripts/unpack-tools.cjs during postinstall; prepublishOnly runs the build.
- The unpacker selects platform-specific difftastic and ripgrep archives and extracts them under tools/unpacked.
- The unpacker expects difft, rg, and ripgrep.node in the destination.
- The flagged index locations compute local friction metrics using Claude project data and logs.
- The flagged API locations derive a Claude project transcript path from the working directory and read that transcript.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
18 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-5AK-_LMu.mjsView file
1001L1002: const execAsync = promisify(exec$2);
L1003: const pathModule = path__default;
High
Shell
Findings
3 Critical12 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/api-DFzJhSwL.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-DFzJhSwL.cjs
CriticalPrevious Version Dangerous Deltadist/index-Djni8STb.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-5AK-_LMu.mjs
HighSame File Env Network Executiondist/api-5AK-_LMu.mjs
HighCredential Redirect Persistencedist/api-DFzJhSwL.cjs
HighCommand Output Exfiltrationdist/api-5AK-_LMu.mjs
HighSandbox Evasion Gated Capabilitydist/api-5AK-_LMu.mjs
HighCross File Remote Execution Contextdist/api-5AK-_LMu.mjs
Affected versions and remediation
This report applies to thalamus@1.5.71.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.71 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.