thalamus@1.5.79
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 20d ago · by lpm-firewall-aiInspected source shows ordinary path helpers, package-aligned API calls, and explicitly gated loopback-only log shipping. The postinstall-extracted binary archive remains unresolved, so the available evidence does not support either a clean verdict or a confirmed attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package runs its postinstall hook.
Impact
The archive's behavior cannot be determined from the inspected source.
Mechanism
The hook selects a platform archive and extracts it into tools/unpacked; the archive contents were not available for source review.
AI rationale
Inspected source shows ordinary path helpers, package-aligned API calls, and explicitly gated loopback-only log shipping. The postinstall-extracted binary archive remains unresolved, so the available evidence does not support either a clean verdict or a confirmed attack.
Evidence
package.jsonscripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gztools/unpacked
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs scripts/unpack-tools.cjs after install; the script selects and extracts a platform archive into tools/unpacked.
- All four flagged .claude locations construct project paths or process extracted text; they do not show agent configuration mutation.
- The API uses the Thalamus server by default and sends session metadata encrypted in its session request.
- Remote log shipping requires an explicit environment opt-in and is restricted to a loopback server.
Evidence against
- The shipped difftastic archive is binary, and its contents could not be resolved through source inspection.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
20 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-BEIvInbr.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = thalamus@1.5.74
matchedIdentity = npm:dGhhbGFtdXM:1.5.74
similarity = 0.761
summary = stored previous version shares package body but lacks this dangerous source file
Findings
4 Critical13 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-R-u2HeEs.cjs
CriticalEncrypted Payload Temp Executiondist/api-Hf5NEgfd.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-Hf5NEgfd.cjs
CriticalPrevious Version Dangerous Deltadist/api-BEIvInbr.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-BEIvInbr.mjs
HighSame File Env Network Executiondist/api-BEIvInbr.mjs
HighCredential Redirect Persistencedist/api-Hf5NEgfd.cjs
HighCommand Output Exfiltrationdist/api-BEIvInbr.mjs
HighSandbox Evasion Gated Capabilitydist/api-BEIvInbr.mjs
Affected versions and remediation
This report applies to thalamus@1.5.79.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.79 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.