thalamus@1.5.81
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 18d ago · by lpm-firewall-aiSource inspection found the postinstall extraction path, but the bundled executable archive remains unresolved after offline analysis. The inspected agent-related source excerpts do not establish an attack; manual review is warranted because archive behavior remains unknown.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall script and may extract the platform-specific archive.
Impact
The archive’s behavior cannot be determined from the available inspection, so a clean verdict is not supported.
Mechanism
The script gunzips and extracts the archive into the package’s tools directory; the available offline analysis could not inspect its expanded contents within budget.
AI rationale
Source inspection found the postinstall extraction path, but the bundled executable archive remains unresolved after offline analysis. The inspected agent-related source excerpts do not establish an attack; manual review is warranted because archive behavior remains unknown.
Evidence
package.jsonscripts/unpack-tools.cjs.lpm-inspection-lWmUje/0-eb2deb082b1c.txttools/archives/difftastic-arm64-linux.tar.gz
Decision evidence
public snapshotAI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package postinstall runs the tool-unpacking script.
- The script extracts the platform-specific difftastic archive during installation.
- The trusted offline analysis reports that the archive’s expanded contents exceeded the structural inspection budget, leaving its behavior unresolved.
- The flagged Claude-related source locations read transcript paths and project data; they do not establish an agent-configuration attack.
Evidence against
- The inspected archive unpacking code extracts bundled tools; the inspected excerpt shows no network transfer or consumer configuration change.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
20 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index-DAqJgfBG.mjsView file
5001const { stdout } = await exec$4(
L5002: "powershell.exe",
L5003: ["-NoProfile", "-NonInteractive", "-Command", WIN_PROCESS_QUERY],
High
Findings
4 Critical13 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-DMvpvbVF.cjs
CriticalEncrypted Payload Temp Executiondist/api-B42lCXGT.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-B42lCXGT.cjs
CriticalPrevious Version Dangerous Deltadist/api-VMe9l-Dy.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index-DAqJgfBG.mjs
HighSame File Env Network Executiondist/api-B42lCXGT.cjs
HighCredential Redirect Persistencedist/api-B42lCXGT.cjs
HighCommand Output Exfiltrationdist/api-B42lCXGT.cjs
HighSandbox Evasion Gated Capabilitydist/api-B42lCXGT.cjs
Affected versions and remediation
This report applies to thalamus@1.5.81.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.81 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.