thalamus@1.5.74
Mobile and Web client for Claude Code
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe source supports a warning for first-party agent extension setup: eligible runtime sessions load bundled workflow skills through a plugin directory. The inspected postinstall hook unpacks platform tools, and the supplied integration locations do not establish a separate attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review
Trigger
Launching a session type that enables workflow skills when the Claude executable supports plugin directories.
Impact
The launched Claude session can use the bundled workflow skills; no broader agent configuration change was established.
Mechanism
The package materializes its bundled skill files under the Thalamus home directory and passes that directory to Claude.
AI rationale
The source supports a warning for first-party agent extension setup: eligible runtime sessions load bundled workflow skills through a plugin directory. The inspected postinstall hook unpacks platform tools, and the supplied integration locations do not establish a separate attack.
Evidence
dist/api-C5lncKMu.cjsThalamus home directory/plugins/workflows/<hash>
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook runs a tool unpacker that extracts platform-specific archives.
- The four supplied agent-integration locations concern Claude project paths and friction-metrics state.
- Runtime code writes bundled workflow skills as a plugin under Thalamus's home directory.
- Eligible session types pass that plugin directory to Claude when launching a session.
- The unpacking code selects archives by the current platform.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
18 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-C5lncKMu.cjsView file
•context = return { rollup: UsageRollup.fromState(JSON.parse(node_fs.readFileSync(path, "utf8"))), existed: true };\n } catch (error) {\n logger.logger.warn(`[usage] unreadable rollup state ${path}, starting fresh:`, error);\n return { rollup: new UsageRollup(), existed: false };\n }\n}\nfunction saveRollup(name, rollup, dir = usageStateDir()) {\n const path = usageStatePath(name, dir);\n if (!path) return;\n const tmp = `${path}.${process.pid}.tmp`;\n try {\n node_fs.mkdirSync(dir, { recursive: true });\n node_fs.writeFileSync(tmp, JSON.stringify(rollup.toState(Date.now())));\n node_fs.renameSync(tmp, path);\n } catch (error) {\n logger.logger.warn(`[usage] could not persist rollup ${path}:`, error);\n try {\n node_fs.unlinkSync(tmp);\n } catch {\n }\
Findings
3 Critical12 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/api-C5lncKMu.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-C5lncKMu.cjs
CriticalPrevious Version Dangerous Deltadist/index-BvC570WK.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-C5lncKMu.cjs
HighSame File Env Network Executiondist/api-C5lncKMu.cjs
HighCredential Redirect Persistencedist/api-C5lncKMu.cjs
HighCommand Output Exfiltrationdist/api-C5lncKMu.cjs
HighSandbox Evasion Gated Capabilitydist/api-C5lncKMu.cjs
HighCross File Remote Execution Contextdist/api-BG_G56v3.mjs
Affected versions and remediation
This report applies to thalamus@1.5.74.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.74 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.