thalamus@1.5.80
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe install hook extracts native binaries whose behavior remains unresolved, preventing a clean assessment. The inspected Claude project metrics code does not establish an attack, and the binary uncertainty alone does not support a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation triggers the postinstall script.
Impact
The behavior of the extracted executables cannot be assessed from the inspected source, so a clean verdict is not established.
Mechanism
The script selects platform-specific archives and extracts their contents into the package's tools/unpacked directory.
AI rationale
The install hook extracts native binaries whose behavior remains unresolved, preventing a clean assessment. The inspected Claude project metrics code does not establish an attack, and the binary uncertainty alone does not support a malicious verdict.
Evidence
package.jsonscripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gztools/archives/ripgrep-arm64-linux.tar.gztools/unpacked
Decision evidence
public snapshotAI called this Manual Review at 81.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package runs an install hook that extracts platform-specific bundled archives into tools/unpacked, preserving archive file modes.
- The flagged runtime locations resolve to Claude project directories and local logs; the metrics helper scans transcript text and derives usage aggregates.
- The bundled archives contain native executables whose behavior was not established by source inspection.
Evidence against
- The inspected metrics code records session and friction aggregates rather than placing transcript text in the metrics result.
- No concrete credential theft or malicious runtime behavior was established in the inspected source.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
20 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-B6dJLpKh.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = thalamus@1.5.74
matchedIdentity = npm:dGhhbGFtdXM:1.5.74
similarity = 0.674
summary = stored previous version shares package body but lacks this dangerous source file
Findings
4 Critical13 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-DOMcLxZC.cjs
CriticalEncrypted Payload Temp Executiondist/index-DOMcLxZC.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-OHA2IRH2.cjs
CriticalPrevious Version Dangerous Deltadist/api-B6dJLpKh.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-B6dJLpKh.mjs
HighSame File Env Network Executiondist/api-B6dJLpKh.mjs
HighCredential Redirect Persistencedist/api-OHA2IRH2.cjs
HighCommand Output Exfiltrationdist/api-B6dJLpKh.mjs
HighSandbox Evasion Gated Capabilitydist/api-B6dJLpKh.mjs
Affected versions and remediation
This report applies to thalamus@1.5.80.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.80 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.