thalamus@1.5.87
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe inspected runtime telemetry and flagged agent-path helpers do not establish the scanner’s claimed credential or agent-control attack. The postinstall-extracted Linux ARM64 archive remains materially uninspected, so the package cannot be cleared or classified from available source evidence.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation on Linux ARM64 triggers the postinstall extraction.
Impact
The unresolved archive content prevents determining whether the extracted tool contains harmful behavior.
Mechanism
The script extracts the platform archive into tools/unpacked; the archive's expanded contents could not be structurally inspected within the available analysis budget.
AI rationale
The inspected runtime telemetry and flagged agent-path helpers do not establish the scanner’s claimed credential or agent-control attack. The postinstall-extracted Linux ARM64 archive remains materially uninspected, so the package cannot be cleared or classified from available source evidence.
Evidence
scripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gz.lpm-inspection-HkVdzc/0-eb2deb082b1c.txt
Decision evidence
public snapshotAI called this Manual Review at 88.0% confidence as Unknown with high false-positive risk.
AI review observations
- The postinstall hook runs scripts/unpack-tools.cjs, which unpacks a platform archive into tools/unpacked.
- The Linux ARM64 archive expands to over 113 MB, and its trusted offline analysis says the expanded content exceeded the inspection limit.
- Daemon runtime telemetry samples the host name and memory usage, encrypts the samples with an organization key, and posts them to the configured Thalamus server; the daemon starts this telemetry automatically.
- The four flagged agent-configuration locations resolve to helpers that construct Claude project paths.
Evidence against
- The inspected telemetry path sends sampled host hardware details, not credentials or application records, and targets the configured Thalamus server.
- The inspected postinstall script extracts local tool archives; no payload execution or unrelated project mutation was established from the inspected source.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
20 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/index-Xw36lUky.cjsView file
9var persistence = require('./persistence-B1Vnpf0C.cjs');
L10: var child_process = require('child_process');
L11: var psList = require('ps-list');
...
L14: var path = require('node:path');
L15: var axios = require('axios');
L16: var fs$1 = require('fs/promises');
...
L103: }
L104: const body = await res.json().catch(() => null);
L105: if (res.status === 404) return body?.error === "Not found" ? { kind: "not-found" } : { kind: "retry" };
...
L530: }
L531: if (process.platform !== "darwin") {
L532: logger.logger.debug("[caffeinate] Not on macOS, skipping caffeinate");
Findings
4 Critical13 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-Xw36lUky.cjs
CriticalEncrypted Payload Temp Executiondist/index-Xw36lUky.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-BBjL4VkY.cjs
CriticalPrevious Version Dangerous Deltadist/api-BBjL4VkY.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/index-Xw36lUky.cjs
HighSame File Env Network Executiondist/api-BBjL4VkY.cjs
HighCredential Redirect Persistencedist/api-BBjL4VkY.cjs
HighCommand Output Exfiltrationdist/api-BBjL4VkY.cjs
HighSandbox Evasion Gated Capabilitydist/index-Xw36lUky.cjs
Affected versions and remediation
This report applies to thalamus@1.5.87.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.87 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.