thalamus@1.5.86
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe inspected runtime paths did not establish credential theft or agent-control abuse. The install hook extracts an archive whose expanded contents remain materially unresolved, so manual review is appropriate.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation invokes the postinstall hook.
Impact
The archive's behavior remains unresolved, so the package cannot be cleared from this inspection.
Mechanism
The hook extracts platform-specific tools into tools/unpacked; the available offline analysis reports that the archive contents exceed its inspection limit.
AI rationale
The inspected runtime paths did not establish credential theft or agent-control abuse. The install hook extracts an archive whose expanded contents remain materially unresolved, so manual review is appropriate.
Evidence
package.jsonscripts/unpack-tools.cjs.lpm-inspection-CRuMgV/0-eb2deb082b1c.txttools/unpacked
Decision evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The postinstall hook runs the local tool unpacker.
- The unpacker selects a platform-specific archive and extracts it into tools/unpacked.
- The offline analysis identifies the flagged archive as gzip but says its expanded contents exceed the inspection limit.
- The Anthropic OAuth token registration path sends the token to the configured Thalamus server after the user runs the connect flow.
Evidence against
- The reviewed OAuth path uses the configured Thalamus server and is activated by an explicit connection flow.
- The flagged agent-configuration locations inspected contain transcript and friction-metrics logic, not an agent configuration mutation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
20 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-DWj5ZTfh.cjsView file
•context = return { rollup: UsageRollup.fromState(JSON.parse(node_fs.readFileSync(path, "utf8"))), existed: true };\n } catch (error) {\n logger.logger.warn(`[usage] unreadable rollup state ${path}, starting fresh:`, error);\n return { rollup: new UsageRollup(), existed: false };\n }\n}\nfunction saveRollup(name, rollup, dir = usageStateDir()) {\n const path = usageStatePath(name, dir);\n if (!path) return;\n const tmp = `${path}.${process.pid}.tmp`;\n try {\n node_fs.mkdirSync(dir, { recursive: true });\n node_fs.writeFileSync(tmp, JSON.stringify(rollup.toState(Date.now())));\n node_fs.renameSync(tmp, path);\n } catch (error) {\n logger.logger.warn(`[usage] could not persist rollup ${path}:`, error);\n try {\n node_fs.unlinkSync(tmp);\n } catch {\n }\
Findings
4 Critical13 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-OZKQItp4.cjs
CriticalEncrypted Payload Temp Executiondist/api-DWj5ZTfh.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-DWj5ZTfh.cjs
CriticalPrevious Version Dangerous Deltadist/api-DWj5ZTfh.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-DWj5ZTfh.cjs
HighSame File Env Network Executiondist/api-DWj5ZTfh.cjs
HighCredential Redirect Persistencedist/api-DWj5ZTfh.cjs
HighCommand Output Exfiltrationdist/api-DWj5ZTfh.cjs
HighSandbox Evasion Gated Capabilitydist/api-DWj5ZTfh.cjs
Affected versions and remediation
This report applies to thalamus@1.5.86.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.86 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.