teammesh@0.10.1
⚠ Under reviewTeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe inspected JavaScript shows a platform-specific binary staging step and a CLI shim that forwards user arguments to native code. Because the native runtime remains materially unresolved, manual review is warranted; the available evidence does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the tm CLI invokes the platform-specific native executable; npm postinstall may replace the JavaScript shim with that executable.
Impact
The native CLI behavior cannot be assessed from the available source evidence, so a clean verdict is not established.
Mechanism
The shim passes command-line arguments to the native binary. Available offline analyses do not resolve several binaries and report uninspected targets in the Windows binary.
AI rationale
The inspected JavaScript shows a platform-specific binary staging step and a CLI shim that forwards user arguments to native code. Because the native runtime remains materially unresolved, manual review is warranted; the available evidence does not establish malicious behavior.
Evidence
.lpm-inspection-gEi3zm/5-bb6c4e62dded.txt.lpm-inspection-gEi3zm/1-4364266e6e36.txt.lpm-inspection-gEi3zm/2-206c019a9ee3.txt.lpm-inspection-gEi3zm/4-4b97baf9df6d.txt.lpm-inspection-gEi3zm/3-f98754829eb3.txtpackage.jsoninstall.jsbin/tm.jsnative/linux-x64/tmnative/linux-arm64/tmnative/darwin-x64/tmnative/darwin-arm64/tmnative/win32-x64/tm.exenative/win32-arm64/tm.exe
Decision evidence
public snapshotAI called this Manual Review at 94.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package runs install.js during postinstall.
- The install hook copies a platform native executable, smoke-tests it, then replaces the CLI shim.
- The CLI forwards its arguments to the native executable, which contains the substantive runtime behavior.
- Offline analysis could not identify several native binaries, and the Windows analysis reports uninspected call targets.
Evidence against
- The install hook exits on Windows and when the npm user-agent check fails.
- The inspected JavaScript contains no network request or credential-transfer behavior.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg18"postinstall": "node install.js"
},
"files": [
"bin"
Low
Suspicious Lifecycle Evidence
The package runs install.js during postinstall.
package.jsonView on unpkg · L18native/win32-arm64/tm.exeView file
Findings
1 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarynative/win32-arm64/tm.exe
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidenceinstall.js
LowAi Review Evidencebin/tm.js
LowAi Review Evidence.lpm-inspection-gEi3zm/5-bb6c4e62dded.txt
Affected versions and remediation
This report applies to teammesh@0.10.1.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.10.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.