thalamus@1.5.98
⚠ Under reviewMobile and Web client for Claude Code
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe inspected telemetry path reports host resource measurements to the configured Thalamus service, and does not establish unrelated credential exfiltration. The shipped executable archive remains materially unresolved, so a clean verdict is not supported by this inspection.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall hook.
Impact
The available source does not establish whether the extracted executables have harmful behavior.
Mechanism
The hook decompresses and extracts the platform tools archive while preserving file modes; the archive contents remain unresolved.
AI rationale
The inspected telemetry path reports host resource measurements to the configured Thalamus service, and does not establish unrelated credential exfiltration. The shipped executable archive remains materially unresolved, so a clean verdict is not supported by this inspection.
Evidence
.lpm-inspection-GmNXyW/0-eb2deb082b1c.txtpackage.jsonscripts/unpack-tools.cjstools/archives/difftastic-arm64-linux.tar.gz
Decision evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The install hook runs a script that extracts the shipped tool archive and preserves file modes.
- The archive analysis reports that expanded contents exceeded the structural inspection budget, leaving the executable contents unresolved.
- Runtime host telemetry collects the host name and RAM/GPU measurements and posts them to the configured Thalamus server; this does not establish an unrelated recipient.
Evidence against
- The inspected telemetry path uses the configured service endpoint; no unrelated receiver was established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
20 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/thalamus-mcp.mjsView file
2L3: import { spawn } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
bin/thalamus-mcp.mjsView on unpkg · L2dist/api-lmh2ykwt.mjsView file
1125L1126: const execAsync = promisify(exec$4);
L1127: const pathModule = path__default;
High
Shell
Findings
4 Critical13 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index-BDPVQaAf.cjs
CriticalEncrypted Payload Temp Executiondist/api-Dj6FYoix.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/api-Dj6FYoix.cjs
CriticalPrevious Version Dangerous Deltadist/index-BDPVQaAf.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/thalamus-mcp.mjs
HighShelldist/api-lmh2ykwt.mjs
HighSame File Env Network Executiondist/api-lmh2ykwt.mjs
HighCredential Redirect Persistencedist/api-Dj6FYoix.cjs
HighCommand Output Exfiltrationdist/api-lmh2ykwt.mjs
HighSandbox Evasion Gated Capabilitydist/api-lmh2ykwt.mjs
Affected versions and remediation
This report applies to thalamus@1.5.98.
See all versions of thalamus for other recorded verdicts.
- Review the evidence and your use of thalamus@1.5.98 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.