teammesh@0.26.1
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected JavaScript shows a postinstall binary swap and direct native CLI dispatch, while the bundled executables remain materially unresolved. This supports a warning for unresolved executable behavior, but the inspected evidence does not establish a concrete attack.
Decision evidence
public snapshot- The postinstall hook runs install.js, which can replace the CLI shim with a bundled native executable.
- The CLI forwards its arguments to that native executable; several platform binaries could not be structurally analyzed, and the Windows x64 analysis left call targets uninspected.
- No concrete malicious behavior was established from the inspected source.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall hook runs install.js, which can replace the CLI shim with a bundled native executable.
package.jsonView on unpkg · L18Findings
Affected versions and remediation
This report applies to teammesh@0.26.1.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.26.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.