thalamus@1.5.85
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 19d ago · by lpm-firewall-aiInspected source supports ordinary unpacking and local project-metric behavior, and the optional log path is explicitly gated and loopback-limited. The executable archive and substantial bundle behavior remain unresolved, so source inspection does not support either a clean verdict or a confirmed attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall hook; archive extraction occurs when the expected tools are not already unpacked.
Impact
The inspected source does not establish malicious effects, but unresolved executable archive and bundle behavior prevents a clean determination.
Mechanism
The hook extracts platform-specific archives into the package tools directory. The inspected agent-related code reads Claude project data for metrics, while optional log shipping is opt-in and loopback-restricted.
AI rationale
Inspected source supports ordinary unpacking and local project-metric behavior, and the optional log path is explicitly gated and loopback-limited. The executable archive and substantial bundle behavior remain unresolved, so source inspection does not support either a clean verdict or a confirmed attack.
Evidence
tools/archives/difftastic-arm64-linux.tar.gzdist/api-CEpE4NIv.mjsdist/api-Ce9lcMPT.cjsdist/index-BdZKnOIS.mjsdist/index-CTg5KdPT.cjstools/unpacked
Decision evidence
public snapshotAI called this Manual Review at 68.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The postinstall hook runs a bundled tool unpacker; its source selects platform archives and unpacks them into the package tools directory.
- The flagged API locations derive Claude project-data paths or read those project logs to compute local friction metrics.
- The MCP bin launches the package’s local bridge.
- Optional remote log shipping requires an explicit environment opt-in and restricts the configured server to loopback.
Evidence against
- The shipped Linux arm64 archive is executable, but its contents could not be resolved from inspected source.
- The main flagged bundles are large and were inspected only at the required agent-related locations; their remaining behavior is unresolved.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
20 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index-BdZKnOIS.mjsView file
3912const { stdout } = await exec$4(
L3913: "powershell.exe",
L3914: ["-NoProfile", "-NonInteractive", "-Command", WIN_PROCESS_QUERY],
High
Findings
4 Critical13 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-CTg5KdPT.cjs
CriticalEncrypted Payload Temp Executiondist/index-CTg5KdPT.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-Ce9lcMPT.cjs
CriticalPrevious Version Dangerous Deltadist/api-Ce9lcMPT.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index-BdZKnOIS.mjs
HighSame File Env Network Executiondist/api-Ce9lcMPT.cjs
HighCredential Redirect Persistencedist/api-Ce9lcMPT.cjs
HighCommand Output Exfiltrationdist/api-Ce9lcMPT.cjs
HighSandbox Evasion Gated Capabilitydist/index-CTg5KdPT.cjs
Affected versions and remediation
This report applies to thalamus@1.5.85.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.85 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.