teammesh@0.18.0
⚠ Under reviewTeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe JavaScript install hook performs a platform-dependent native binary validation and shim replacement, while the CLI delegates runtime work to that binary. Available analyses leave the native code materially unresolved, so the source does not support a clean or malicious conclusion.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing with npm on a supported non-Windows platform, or invoking the tm command.
Impact
The unresolved binary behavior prevents determining whether installation or CLI use has harmful effects.
Mechanism
The installer runs the staged binary with --version before replacing bin/tm.js; the shim later launches the platform binary with the supplied arguments.
AI rationale
The JavaScript install hook performs a platform-dependent native binary validation and shim replacement, while the CLI delegates runtime work to that binary. Available analyses leave the native code materially unresolved, so the source does not support a clean or malicious conclusion.
Evidence
.lpm-inspection-6C2U0Q/0-af0009d09f56.txt.lpm-inspection-6C2U0Q/1-1339c22aa110.txt.lpm-inspection-6C2U0Q/2-7cb20fd87d19.txt.lpm-inspection-6C2U0Q/3-08f91e276165.txt.lpm-inspection-6C2U0Q/4-568aa750afb6.txt.lpm-inspection-6C2U0Q/5-3fa7fd17fe74.txtinstall.jsbin/tm.jsnative/linux-arm64/tmnative/linux-x64/tmnative/darwin-arm64/tmnative/darwin-x64/tmnative/win32-arm64/tm.exenative/win32-x64/tm.exe
Decision evidence
public snapshotAI called this Manual Review at 89.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package runs install.js from its postinstall hook.
- On npm outside Windows, the hook stages a platform binary, runs it with --version, then replaces the CLI shim with it.
- The CLI shim also launches the matching platform binary with the caller's arguments.
- Offline analyses leave the shipped binaries unresolved; one Windows x64 analysis also reports uninspected call targets.
Evidence against
- The install hook only proceeds for npm on non-Windows systems with a matching binary, and removes the staged file if validation fails.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg18"postinstall": "node install.js"
},
"files": [
"bin",
"nat
Low
Suspicious Lifecycle Evidence
The package runs install.js from its postinstall hook.
package.jsonView on unpkg · L18native/win32-arm64/tm.exeView file
Findings
1 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarynative/win32-arm64/tm.exe
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceinstall.js
LowAi Review Evidenceinstall.js
LowAi Review Evidencebin/tm.js
Affected versions and remediation
This report applies to teammesh@0.18.0.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.18.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.