thalamus@1.5.83
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe inspected agent-configuration references resolve to project transcript paths and conditional skill setup, and the inspected telemetry uses the configured Thalamus server. The postinstall archive analysis remains materially incomplete, so its executable contents cannot be cleared or classified from the available source evidence.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm postinstall invokes scripts/unpack-tools.cjs.
Impact
The archive supplies installed executables, but their behavior remains unverified because structural analysis was incomplete.
Mechanism
The unpacker selects platform-specific archives and extracts their contents into tools/unpacked.
AI rationale
The inspected agent-configuration references resolve to project transcript paths and conditional skill setup, and the inspected telemetry uses the configured Thalamus server. The postinstall archive analysis remains materially incomplete, so its executable contents cannot be cleared or classified from the available source evidence.
Evidence
scripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gz.lpm-inspection-cWuqiX/0-eb2deb082b1c.txtpackage.jsontools/unpacked
Decision evidence
public snapshotAI called this Manual Review at 88.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs scripts/unpack-tools.cjs during postinstall.
- The unpacker selects platform-specific difftastic and ripgrep archives and extracts them into tools/unpacked.
- The trusted analysis for difftastic-arm64-linux.tar.gz reports that its expanded contents exceeded the structural inspection budget.
- The .claude references in both API bundles construct Claude project paths; the ESM bundle uses those paths to read session transcripts.
- The .claude/projects references in both CLI bundles supply project data to friction-metrics processing.
- Workflow skill plugins are materialized only when wantsSkills is true.
Evidence against
- The inspected agent-configuration hints resolve to Claude project and transcript paths or conditional workflow-skill setup.
- The inspected telemetry sender posts to the configured Thalamus server; no unrelated credential recipient was established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
20 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-De5NNARf.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = thalamus@1.5.74
matchedIdentity = npm:dGhhbGFtdXM:1.5.74
similarity = 0.674
summary = stored previous version shares package body but lacks this dangerous source file
Findings
4 Critical13 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-C2FAK1AW.cjs
CriticalEncrypted Payload Temp Executiondist/api-Dkeskyxl.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-Dkeskyxl.cjs
CriticalPrevious Version Dangerous Deltadist/api-De5NNARf.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-De5NNARf.mjs
HighSame File Env Network Executiondist/api-De5NNARf.mjs
HighCredential Redirect Persistencedist/api-Dkeskyxl.cjs
HighCommand Output Exfiltrationdist/api-De5NNARf.mjs
HighSandbox Evasion Gated Capabilitydist/api-De5NNARf.mjs
Affected versions and remediation
This report applies to thalamus@1.5.83.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.83 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.