teammesh@0.28.2
⚠ Under reviewTeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe inspected JavaScript shows an npm postinstall replacing the CLI wrapper with a bundled native executable, and the wrapper launches that executable. Offline analysis could not resolve the behavior of most binaries and was incomplete for the supported Windows binary, so the package’s core runtime behavior remains unresolved without evidence sufficient to classify it as malicious.
Decision evidence
public snapshot- package.json defines an npm postinstall hook that runs install.js and exposes bin/tm.js as the tm command.
- On supported npm platforms, install.js stages the matching native executable and replaces bin/tm.js after checking that it runs.
- The CLI wrapper selects a platform-specific native executable and launches it with the supplied arguments.
- Offline analysis could not inspect most shipped native executables; the Windows x64 analysis also leaves call targets uninspected.
- The inspected source establishes native executable dispatch but does not establish malicious behavior.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json defines an npm postinstall hook that runs install.js and exposes bin/tm.js as the tm command.
package.jsonView on unpkg · L14Findings
Affected versions and remediation
This report applies to teammesh@0.28.2.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.28.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.