thalamus@1.5.72
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe flagged Claude-related source locations access local project transcripts and metrics, with no observed agent configuration mutation. The install hook extracts a bundled archive whose contents could not be inspected, so the package remains unresolved.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review
Trigger
Installing the package runs its postinstall hook.
Impact
The archive contents remain unresolved, so their behavior and any resulting impact cannot be determined from this inspection.
Mechanism
The hook extracts platform-specific tool archives into the package tools directory and sets extracted files executable.
AI rationale
The flagged Claude-related source locations access local project transcripts and metrics, with no observed agent configuration mutation. The install hook extracts a bundled archive whose contents could not be inspected, so the package remains unresolved.
Evidence
package.jsonscripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gz.lpm-inspection-pxRMGr/0-eb2deb082b1c.txt
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest runs the tool unpacker automatically after installation.
- The unpacker selects a platform-specific archive and extracts its contents into the package tools directory.
- The offline inspection could not inspect the archive because it exceeded the analysis buffer limit.
- The Claude-related locations read project transcripts or compute metrics from local Claude logs; they do not show agent settings being changed.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
18 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index-Dweq545y.cjsView file
•context = ] ?? 0;\n if (va > vb) return 1;\n if (va < vb) return -1;\n }\n return 0;\n}\nfunction isCacheUsable(cached, currentVersion, now) {\n if (!cached) return false;\n if (now - cached.checkedAt >= CACHE_TTL_MS) return false;\n if (compareSemver(currentVersion, cached.latestVersion) > 0) return false;\n return true;\n}\nfunction readCache() {\n try {\n const raw = node_fs.readFileSync(CACHE_FILE, "utf-8");\n return JSON.parse(raw);\n } catch {\n return null;\n }\n}\nfunction writeCache(cache) {\n try {\n node_fs.writeFileSync(CACHE_FILE, JSON.stringify(cache), "utf-8");\n } catch {\n }\n}\nasync function fetchLatestVersion() {\n try {\n const response = await axios.get(\n `https://registry.npmjs.org/${NPM_PACKAGE_NAME}/latest`,\n { timeout:
Findings
3 Critical12 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index-Dweq545y.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-BSZLGylf.cjs
CriticalPrevious Version Dangerous Deltadist/terminalBackend.pty-Cg86Yeie.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index-Dweq545y.cjs
HighSame File Env Network Executiondist/api-BSZLGylf.cjs
HighCredential Redirect Persistencedist/api-BSZLGylf.cjs
HighCommand Output Exfiltrationdist/api-BSZLGylf.cjs
HighSandbox Evasion Gated Capabilitydist/index-Dweq545y.cjs
HighCross File Remote Execution Context
Affected versions and remediation
This report applies to thalamus@1.5.72.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.72 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.