teammesh@0.17.0
⚠ Under reviewTeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe JavaScript installer and CLI wrapper show a bounded native-binary selection and execution flow. Because the shipped executables could not be adequately inspected, their behavior remains materially unresolved; no specific attack was established.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation through npm on a supported non-Windows platform, or running the tm CLI.
Impact
The native executable's behavior cannot be determined from the available offline analyses, so its effects remain unknown.
Mechanism
The postinstall hook tests a matching native binary and replaces the JavaScript shim; the shim forwards CLI arguments to that binary.
AI rationale
The JavaScript installer and CLI wrapper show a bounded native-binary selection and execution flow. Because the shipped executables could not be adequately inspected, their behavior remains materially unresolved; no specific attack was established.
Evidence
.lpm-inspection-Omsv6P/0-dbaa0040773f.txt.lpm-inspection-Omsv6P/1-4c9d903c657e.txt.lpm-inspection-Omsv6P/2-f536d786c443.txt.lpm-inspection-Omsv6P/3-523f3700325c.txt.lpm-inspection-Omsv6P/4-cf212c66464f.txt.lpm-inspection-Omsv6P/5-77a538ddd3e4.txtinstall.jsbin/tm.jsnative/win32-arm64/tm.exenative/linux-arm64/tmnative/darwin-x64/tmnative/win32-x64/tm.exenative/darwin-arm64/tmnative/linux-x64/tm
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs install.js as a postinstall hook.
- On supported npm platforms, install.js selects a matching native binary, runs it with --version, and replaces bin/tm.js if it succeeds.
- bin/tm.js forwards the CLI arguments to the matching native binary.
- Offline analyses could not inspect five shipped binaries and only partially analyzed the Windows x64 binary.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg14"bin": {
"tm": "bin/tm.js"
},
"scripts": {
"postinstall": "node install.js"
},
"files": [
"bin",
Low
Suspicious Lifecycle Evidence
package.json runs install.js as a postinstall hook.
package.jsonView on unpkg · L14native/win32-arm64/tm.exeView file
Findings
1 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarynative/win32-arm64/tm.exe
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceinstall.js
LowAi Review Evidencebin/tm.js
LowAi Review Evidence.lpm-inspection-Omsv6P/0-dbaa0040773f.txt
Affected versions and remediation
This report applies to teammesh@0.17.0.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.17.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.