thalamus@1.5.82
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe inspected source shows a postinstall extraction step and package-aligned encrypted host telemetry, but does not establish an attack. The executable archive’s contents remain materially unresolved, so manual review is warranted.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The postinstall hook extracts packaged tools; runtime host telemetry starts when the relevant daemon path is activated.
Impact
No malicious effect is confirmed; the uninspected archive prevents resolving whether its contents add risky behavior.
Mechanism
The installer unpacks compressed tools, and the inspected runtime code collects host metrics, encrypts them, and posts them to the configured service.
AI rationale
The inspected source shows a postinstall extraction step and package-aligned encrypted host telemetry, but does not establish an attack. The executable archive’s contents remain materially unresolved, so manual review is warranted.
Evidence
package.jsonscripts/unpack-tools.cjs.lpm-inspection-uCEuLc/0-eb2deb082b1c.txtdist/index-3SydS0Tn.mjstools/archives/difftastic-arm64-linux.tar.gz
Decision evidence
public snapshotAI called this Manual Review at 87.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The postinstall hook runs a script that extracts the packaged tools archive.
- The archive analysis confirms a compressed artifact but could not inspect its expanded contents, leaving its behavior unresolved.
- The runtime telemetry code samples host hardware data, encrypts it, and sends it to the configured Thalamus server.
- The flagged Claude project-path locations are helpers for accessing project data and logs.
Evidence against
- The inspected telemetry sends encrypted host metrics to the package’s configured service; this source alone does not establish credential theft or an unrelated recipient.
- The MCP executable wrapper spawns the package’s bridge and forwards arguments and signals.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
20 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index-rpiPUQV9.cjsView file
9var persistence = require('./persistence-Dimkr0uz.cjs');
L10: var child_process = require('child_process');
L11: var psList = require('ps-list');
...
L14: var path = require('node:path');
L15: var axios = require('axios');
L16: var fs$1 = require('fs/promises');
...
L103: }
L104: const body = await res.json().catch(() => null);
L105: if (res.status === 404) return body?.error === "Not found" ? { kind: "not-found" } : { kind: "retry" };
...
L530: }
L531: if (process.platform !== "darwin") {
L532: logger.logger.debug("[caffeinate] Not on macOS, skipping caffeinate");
Findings
4 Critical13 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-rpiPUQV9.cjs
CriticalEncrypted Payload Temp Executiondist/index-rpiPUQV9.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-Cy0eSRjm.cjs
CriticalPrevious Version Dangerous Deltadist/api-CXp4Qr1Z.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index-rpiPUQV9.cjs
HighSame File Env Network Executiondist/api-Cy0eSRjm.cjs
HighCredential Redirect Persistencedist/api-Cy0eSRjm.cjs
HighCommand Output Exfiltrationdist/api-Cy0eSRjm.cjs
HighSandbox Evasion Gated Capabilitydist/index-rpiPUQV9.cjs
Affected versions and remediation
This report applies to thalamus@1.5.82.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.82 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.