thalamus@1.5.77
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 21d ago · by lpm-firewall-aiInspected source did not confirm the scanner's suspected attack behavior, and the indicated agent-integration locations concern transcript or friction-metric helpers. The postinstall-extracted binary archive remains unresolved, so the package cannot be cleared from source inspection alone.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review
Trigger
Installing the package runs its postinstall hook.
Impact
The extracted contents could not be assessed from the available source, so their behavior remains undetermined.
Mechanism
The hook selects platform-specific compressed archives and extracts them into the tools directory.
AI rationale
Inspected source did not confirm the scanner's suspected attack behavior, and the indicated agent-integration locations concern transcript or friction-metric helpers. The postinstall-extracted binary archive remains unresolved, so the package cannot be cleared from source inspection alone.
Evidence
package.jsonscripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gz
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs scripts/unpack-tools.cjs during postinstall.
- The installer decompresses and extracts platform archives; their binary contents remain unresolved.
- The four indicated bundle locations handle transcript reading or friction-metric output, not agent configuration changes.
- The reviewed decryption helper returns authenticated bytes; that excerpt does not show execution.
Evidence against
- The reviewed source excerpts do not establish credential theft, an unauthorized agent-setting change, or another concrete attack.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
19 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index--ChDPJxf.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = thalamus@1.5.74
matchedIdentity = npm:dGhhbGFtdXM:1.5.74
similarity = 0.935
summary = stored previous version shares package body but lacks this dangerous source file
Findings
4 Critical12 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index--gy2O6rH.cjs
CriticalEncrypted Payload Temp Executiondist/api-DnDutj-e.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-DnDutj-e.cjs
CriticalPrevious Version Dangerous Deltadist/index--ChDPJxf.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index--ChDPJxf.mjs
HighSame File Env Network Executiondist/api-DnDutj-e.cjs
HighCredential Redirect Persistencedist/api-DnDutj-e.cjs
HighCommand Output Exfiltrationdist/api-DnDutj-e.cjs
HighSandbox Evasion Gated Capabilitydist/api-DnDutj-e.cjs
Affected versions and remediation
This report applies to thalamus@1.5.77.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.77 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.