thalamus@1.5.78
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe inspected source does not establish malicious behavior, but the automatic install hook extracts executable archive contents that could not be verified. Manual review is appropriate until those contents are assessed.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review
Trigger
Package installation runs the postinstall hook.
Impact
The behavior of the extracted executable remains unresolved; no harmful impact is confirmed.
Mechanism
The hook selects a platform archive, extracts it, and marks extracted regular files executable on Unix.
AI rationale
The inspected source does not establish malicious behavior, but the automatic install hook extracts executable archive contents that could not be verified. Manual review is appropriate until those contents are assessed.
Evidence
package.jsonscripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gztools/unpacked
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs scripts/unpack-tools.cjs from postinstall.
- The unpacker selects a platform archive, extracts it with tar, and assigns executable permissions to extracted regular files on Unix.
- The four flagged Claude-related source locations use the local .claude/projects directory for friction metrics or construct local project transcript paths; they do not show configuration writes.
- Remote log shipping requires an explicit environment opt-in and rejects non-loopback hosts.
- The required tools/archives/difftastic-arm64-linux.tar.gz asset could not be read as source bytes, so its executable contents remain unverified.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
20 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index-CRSgovdl.mjsView file
5902const { stdout } = await exec$5(
L5903: "powershell.exe",
L5904: ["-NoProfile", "-NonInteractive", "-Command", WIN_PROCESS_QUERY],
High
Findings
4 Critical13 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-CYhA5K2M.cjs
CriticalEncrypted Payload Temp Executiondist/index-CYhA5K2M.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-DGyO46t8.cjs
CriticalPrevious Version Dangerous Deltadist/index-CYhA5K2M.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index-CRSgovdl.mjs
HighSame File Env Network Executiondist/api-DGyO46t8.cjs
HighCredential Redirect Persistencedist/api-DGyO46t8.cjs
HighCommand Output Exfiltrationdist/api-DGyO46t8.cjs
HighSandbox Evasion Gated Capabilitydist/index-CYhA5K2M.cjs
Affected versions and remediation
This report applies to thalamus@1.5.78.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.78 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.