teammesh@0.28.1
⚠ Under reviewTeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe inspected JavaScript shows a bounded installer and a launcher that delegates to native binaries. Their behavior remains materially unresolved across the shipped platforms, so the available source evidence does not support a clean or malicious verdict.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation runs the postinstall hook; invoking tm launches the platform-specific native executable.
Impact
The effect of native CLI execution cannot be determined from the inspected evidence.
Mechanism
The hook stages and checks a native binary, and the CLI delegates commands to it. Available offline analyses do not resolve the behavior of the shipped binaries.
AI rationale
The inspected JavaScript shows a bounded installer and a launcher that delegates to native binaries. Their behavior remains materially unresolved across the shipped platforms, so the available source evidence does not support a clean or malicious verdict.
Evidence
.lpm-inspection-p61sGp/0-aa7280b2a735.txt.lpm-inspection-p61sGp/1-55aba3417439.txt.lpm-inspection-p61sGp/2-712cbab419f7.txt.lpm-inspection-p61sGp/3-c60a71af914d.txt.lpm-inspection-p61sGp/4-c96f44f8cebe.txt.lpm-inspection-p61sGp/5-aafae0cc1352.txtinstall.jsbin/tm.jsnative/linux-arm64/tmnative/linux-x64/tmnative/darwin-x64/tmnative/darwin-arm64/tmnative/win32-arm64/tm.exenative/win32-x64/tm.exe
Decision evidence
public snapshotAI called this Manual Review at 91.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The postinstall hook stages a platform binary and runs it with --version before replacing the CLI shim.
- The CLI forwards its arguments to a shipped native executable.
- Offline analysis leaves five native binaries unresolved and reports incomplete analysis of the Windows x64 binary.
Evidence against
- The inspected JavaScript install hook only stages and checks the binary; the launcher forwards arguments and signals.
- No network endpoint or credential transfer was identified in the inspected JavaScript.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg18"postinstall": "node install.js"
},
"files": [
"bin",
"native",
"install.js",
"LICENSE"
],
"engines": {
"node": ">=18"
}
}
Low
Suspicious Lifecycle Evidence
The postinstall hook stages a platform binary and runs it with --version before replacing the CLI shim.
package.jsonView on unpkg · L18native/win32-arm64/tm.exeView file
Findings
1 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarynative/win32-arm64/tm.exe
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidenceinstall.js
LowAi Review Evidencebin/tm.js
LowAi Review Evidence.lpm-inspection-p61sGp/0-aa7280b2a735.txt
Affected versions and remediation
This report applies to teammesh@0.28.1.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.28.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.