teammesh@0.26.0
⚠ Under reviewTeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe reviewed JavaScript establishes that installation and normal CLI use execute the shipped native binary. Because the available analyses cannot resolve that executable's behavior, the package's runtime cannot be classified as clean or malicious from this inspection.
Decision evidence
public snapshot- The manifest runs install.js after installation; on eligible systems, the hook stages and runs the native binary before replacing the CLI shim.
- The CLI shim passes its arguments to the platform-specific native executable.
- Offline analyses leave the native behavior unresolved: several formats are unsupported, and the Windows x64 analysis is incomplete.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe manifest runs install.js after installation; on eligible systems, the hook stages and runs the native binary before replacing the CLI shim.
package.jsonView on unpkg · L18Findings
Affected versions and remediation
This report applies to teammesh@0.26.0.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.26.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.