teammesh@0.33.0
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe install hook only stages and checks the package's own native CLI, and the JavaScript shim runs that binary on user invocation. Available binary strings point to TeamMesh service endpoints and a crash-reporting setting; limited native analysis did not establish malicious behavior.
Decision evidence
public snapshot- The postinstall hook selects a platform-specific binary and stages it as the CLI shim; the visible installer code does not collect project or host data or contact a network.
- The CLI shim launches the matching bundled native binary with the user's arguments, consistent with the package's stated CLI purpose.
- The readable binary strings name TeamMesh API and sync endpoints, which fit the package's described service.
- The binary strings include a Sentry crash-reporting endpoint and a TM_CRASH_REPORTS setting; the available static view does not show whether reports are sent by default.
- The native executable is the main CLI implementation, and the prepared analysis reports that its call graph is incomplete.
- The installer runs automatically, but only stages and checks the bundled binary before replacing the shim.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall hook selects a platform-specific binary and stages it as the CLI shim; the visible installer code does not collect project or host data or contact a network.
package.jsonView on unpkg · L18Findings
Affected versions and remediation
This report applies to teammesh@0.33.0.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.33.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.