teammesh@0.13.0
⚠ Under reviewTeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe inspected JavaScript shows a postinstall native-binary check and a launcher that delegates to native code. Analysis of the Windows x64 binary is incomplete, leaving material runtime behavior unresolved; manual review is appropriate.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation runs the postinstall hook; invoking the CLI launches the platform-specific native executable.
Impact
The native executable’s runtime effects cannot be determined from the available analysis, so malicious behavior is neither confirmed nor ruled out.
Mechanism
The installer executes a staged binary to check its version and may replace the JavaScript shim with it. The launcher forwards CLI arguments to the native binary.
AI rationale
The inspected JavaScript shows a postinstall native-binary check and a launcher that delegates to native code. Analysis of the Windows x64 binary is incomplete, leaving material runtime behavior unresolved; manual review is appropriate.
Evidence
.lpm-inspection-bXHD6G/3-ca58360846db.txtinstall.jsbin/tm.jsnative/win32-x64/tm.exe
Decision evidence
public snapshotAI called this Manual Review at 83.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The postinstall hook runs install.js, which executes the staged native binary during installation.
- The CLI launcher passes its arguments to a platform-specific native binary.
- The inspected native analysis reports uninspected call targets and cannot establish the binary’s behavior.
Evidence against
- The installer checks the staged binary’s version before replacing the JavaScript shim; no attack behavior is established by the inspected source.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg18"postinstall": "node install.js"
},
"files": [
"bin",
"native",
"install.js",
"L
Low
Suspicious Lifecycle Evidence
The postinstall hook runs install.js, which executes the staged native binary during installation.
package.jsonView on unpkg · L18native/win32-arm64/tm.exeView file
Findings
1 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarynative/win32-arm64/tm.exe
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidenceinstall.js
LowAi Review Evidencebin/tm.js
LowAi Review Evidence.lpm-inspection-bXHD6G/3-ca58360846db.txt
Affected versions and remediation
This report applies to teammesh@0.13.0.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.