teammesh@0.34.1
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe install hook only validates and installs a bundled local binary, with no install-time data transfer found. The binary’s Sentry URL and crash-report setting suggest runtime telemetry, but its behavior and disclosure could not be confirmed, so a warning is appropriate.
Decision evidence
public snapshot- The manifest runs install.js as a postinstall hook; that script validates a copied local binary with --version before replacing the CLI shim.
- The CLI shim forwards the user's arguments to the bundled native binary.
- The Windows binary’s readable string view contains a Sentry ingest URL and a TM_CRASH_REPORTS marker, suggesting crash-report telemetry, though activation and payload are unverified.
- The readable install hook only stages a bundled binary, checks it locally, and swaps the shim; it shows no network request or collection of user data.
- The CLI wrapper simply passes command-line arguments to the bundled binary.
- The binary string view also contains TeamMesh API and sync endpoints consistent with the package’s stated team-connection purpose.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe manifest runs install.js as a postinstall hook; that script validates a copied local binary with --version before replacing the CLI shim.
package.jsonView on unpkg · L18Findings
Affected versions and remediation
This report applies to teammesh@0.34.1.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.34.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.