teammesh@0.34.10
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe install hook performs a platform-specific launcher replacement, validates the binary with --version, and exposes no data-sending behavior. The native strings and endpoints fit the stated team CLI purpose; no concrete attack behavior was identified, though the native analysis leaves some behavior unverified.
Static reason
One or more suspicious static signals were detected.
Trigger
The postinstall hook stages the native binary on supported npm installs; running tm invokes the selected platform binary.
Impact
No malicious collection or unauthorized account action was established from the inspected source. The native analysis is limited, so some binary behavior remains unverified.
Mechanism
The hook runs the staged binary with --version before swapping it into the launcher path. The JavaScript shim forwards user arguments to that binary. Native analysis identifies TeamMesh API and sync endpoints and an environment-gated Sentry crash-report endpoint.
AI rationale
The install hook performs a platform-specific launcher replacement, validates the binary with --version, and exposes no data-sending behavior. The native strings and endpoints fit the stated team CLI purpose; no concrete attack behavior was identified, though the native analysis leaves some behavior unverified.
Evidence
bin/tm.jsbin/tm.js.native
Network endpoints3
api.teammesh.iosync.teammesh.ioo4512288884326400.ingest.us.sentry.io/4512288887013376
Decision evidence
public snapshotAI called this Clean at 78.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook stages the platform binary, checks that it runs with --version, and replaces the JavaScript shim; it does not visibly send data.
- The CLI shim selects the current platform’s bundled binary and forwards command-line arguments to it.
- The native analysis lists TeamMesh API and sync endpoints and a Sentry crash-report endpoint gated by TM_CRASH_REPORTS.
- The package describes itself as a TeamMesh CLI for connecting AI coding agents to a team.
Evidence against
- The native analysis is limited and leaves some call targets uninspected, so it cannot establish every behavior of the bundled binaries.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgnative/win32-arm64/tm.exeView file
•path = native/win32-arm64/tm.exe
kind = native_binary
sizeBytes = 9463808
magicHex = [redacted]
Medium
Findings
1 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarynative/win32-arm64/tm.exe
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
LowSuspicious Lifecycle Evidenceinstall.js
LowAi Review Evidencebin/tm.js
LowAi Review Evidence.lpm-inspection-zwnOPZ/5-6b853925557e.txt
LowAi Review Evidence.lpm-inspection-zwnOPZ/5-6b853925557e.txt
Affected versions and remediation
This report applies to teammesh@0.34.10.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.34.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.