thalamus@1.5.73
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 22d ago · by lpm-firewall-aiSource inspection showed a postinstall archive extraction path, but the non-text archive contents remain unresolved and no concrete attack was verified. The agent-integration hints point to friction-metric and transcript code, not agent-settings changes.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review
Trigger
Installing the package runs its postinstall hook.
Impact
The extracted artifact's behavior remains unknown, so its safety cannot be established from the inspected source.
Mechanism
The hook selects a platform-specific archive, extracts it into tools/unpacked, and sets executable permissions; runtime code uses the extracted difft binary.
AI rationale
Source inspection showed a postinstall archive extraction path, but the non-text archive contents remain unresolved and no concrete attack was verified. The agent-integration hints point to friction-metric and transcript code, not agent-settings changes.
Evidence
package.jsonscripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gzdist/api-Bw5TDcat.cjstools/unpacked
Decision evidence
public snapshotAI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs scripts/unpack-tools.cjs during postinstall.
- The hook extracts a platform-specific archive and preserves archived file modes.
- The hook makes extracted regular files executable on Unix.
- Runtime code resolves difft from tools/unpacked.
- The indicated agent-configuration locations contain friction-metric and transcript-processing code.
Evidence against
- The cited agent-integration locations do not show agent-settings mutation.
- Inspected source does not establish that the archive contains a malicious payload.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
18 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-Bw5TDcat.cjsView file
•context = return { rollup: UsageRollup.fromState(JSON.parse(node_fs.readFileSync(path, "utf8"))), existed: true };\n } catch (error) {\n logger.logger.warn(`[usage] unreadable rollup state ${path}, starting fresh:`, error);\n return { rollup: new UsageRollup(), existed: false };\n }\n}\nfunction saveRollup(name, rollup, dir = usageStateDir()) {\n const path = usageStatePath(name, dir);\n if (!path) return;\n const tmp = `${path}.${process.pid}.tmp`;\n try {\n node_fs.mkdirSync(dir, { recursive: true });\n node_fs.writeFileSync(tmp, JSON.stringify(rollup.toState(Date.now())));\n node_fs.renameSync(tmp, path);\n } catch (error) {\n logger.logger.warn(`[usage] could not persist rollup ${path}:`, error);\n try {\n node_fs.unlinkSync(tmp);\n } catch {\n }\
Findings
3 Critical12 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/api-Bw5TDcat.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-Bw5TDcat.cjs
CriticalPrevious Version Dangerous Deltadist/terminalBackend.pty-Bj5liiz8.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-Bw5TDcat.cjs
HighSame File Env Network Executiondist/api-Bw5TDcat.cjs
HighCredential Redirect Persistencedist/api-Bw5TDcat.cjs
HighCommand Output Exfiltrationdist/api-Bw5TDcat.cjs
HighSandbox Evasion Gated Capabilitydist/api-Bw5TDcat.cjs
HighCross File Remote Execution Contextdist/api--mQB8ne-.mjs
Affected versions and remediation
This report applies to thalamus@1.5.73.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.73 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.