thalamus@1.5.8
Mobile and Web client for Claude Code
AI Security Review
scanned 1mo ago · by lpm-firewall-aiPostinstall unpacks and chmods a binary archive that static review cannot read, so the installed native payload stays unverified. Readable code only reads Claude session files and sends the Claude OAuth token to Anthropic's usage API, which is not an install-time agent hijack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm postinstall executes node scripts/unpack-tools.cjs.
Impact
A native binary of unverified content becomes executable inside the package tree on install. No secret theft or agent-config rewrite was shown in the readable sources.
Mechanism
The script selects tools/archives/difftastic-<platform>.tar.gz, gunzips it into tools/unpacked, and sets mode 755 on extracted non-.node files.
AI rationale
Postinstall unpacks and chmods a binary archive that static review cannot read, so the installed native payload stays unverified. Readable code only reads Claude session files and sends the Claude OAuth token to Anthropic's usage API, which is not an install-time agent hijack.
Evidence
package.jsonscripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gztools/unpacked
Decision evidence
public snapshotAI called this Suspicious at 64.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- npm postinstall runs scripts/unpack-tools.cjs, which gunzips the platform difftastic and ripgrep archives into the package tools directory and chmod 755 on non-.node files.
- tools/archives/difftastic-arm64-linux.tar.gz is a non-UTF8 binary; its bytes cannot be reviewed as source, so the executable extracted at install is opaque.
- getProjectPath only joins CLAUDE_CONFIG_DIR or ~/.claude/projects for reading session jsonl transcripts; it does not write Claude or MCP settings during install.
- readClaudeOAuthToken reads ~/.claude/.credentials.json and fetchOAuthUsage sends that bearer token only to https://api.anthropic.com/api/oauth/usage.
Evidence against
- Expected unpacked names are difft, rg, and ripgrep.node, matching the archive filenames rather than a hidden downloader.
- No preinstall or install hook, and no install-time write to a foreign agent config file, was found.
- The Claude OAuth token is sent to Anthropic's own usage endpoint, not to an operator-chosen host.
Behavioral surface
ChildProcessCrypto
Source & flagged code
13 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { execFileSync } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/lib.cjsView file
•matchType = token_shingles
matchedPackage = claudeputer@1.1.41
matchedPath = dist/lib.cjs
matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
Findings
3 Critical8 High6 Medium5 Low
CriticalEncrypted Payload Temp Executiondist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/index.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShell
HighCredential Redirect Persistencedist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
HighKnown Malware Source Similaritydist/lib.cjs
HighKnown Malware Source Similaritydist/lib.mjs
MediumDynamic Require
Affected versions and remediation
This report applies to thalamus@1.5.8.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.