teammesh@0.33.1
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe readable native-binary analysis shows a Sentry crash-report destination and marker, but cannot establish the telemetry trigger, payload, or opt-out behavior. The visible install hook is a local binary compatibility check, so the unresolved runtime telemetry merits a warning, not a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Unknown; the native binary’s telemetry trigger could not be determined from the readable analysis.
Impact
If enabled by default, runtime or crash information may be sent to Sentry; the collected data and user controls are unverified.
Mechanism
The native binary’s readable analysis contains a Sentry ingest DSN and a TM_CRASH_REPORTS marker.
AI rationale
The readable native-binary analysis shows a Sentry crash-report destination and marker, but cannot establish the telemetry trigger, payload, or opt-out behavior. The visible install hook is a local binary compatibility check, so the unresolved runtime telemetry merits a warning, not a block.
Evidence
.lpm-inspection-cOk04r/5-49466cb550ac.txtnative/win32-x64/tm.exebin/tm.jsbin/tm.js.native
Network endpoints3
api.teammesh.iosync.teammesh.ioo4512288884326400.ingest.us.sentry.io
Decision evidence
public snapshotAI called this Suspicious at 71.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Windows x64 native-analysis view contains a Sentry ingest DSN adjacent to the TM_CRASH_REPORTS marker, but does not establish when reports are sent or what they contain.
- The native-analysis view includes TeamMesh API and sync endpoints, consistent with the package’s team-connecting CLI purpose.
- The postinstall hook stages the platform binary and runs it with --version before replacing the CLI shim.
Evidence against
- The manifest describes a CLI that connects AI coding agents to a team and exposes a single tm command.
- The JavaScript wrapper invokes the platform binary with the user’s CLI arguments.
- The install hook’s visible code performs local file operations and a version check; it contains no network request or credential collection.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgnative/win32-arm64/tm.exeView file
•path = native/win32-arm64/tm.exe
kind = native_binary
sizeBytes = 9439744
magicHex = [redacted]
Medium
Findings
1 High7 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarynative/win32-arm64/tm.exe
MediumStructural Risk Force Deep Review
MediumAi Review Evidence.lpm-inspection-cOk04r/5-49466cb550ac.txt
MediumAi Review Evidence.lpm-inspection-cOk04r/5-49466cb550ac.txt
MediumSuspicious Lifecycle Evidenceinstall.js
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to teammesh@0.33.1.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.33.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.