teammesh@0.34.11
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe native binary's Sentry endpoint and `TM_CRASH_REPORTS` string suggest crash telemetry, but the available inspection does not establish its trigger, default, or payload. This warrants a warning rather than a malicious verdict.
Static reason
One or more suspicious static signals were detected.
Trigger
Unclear; likely runtime crash reporting, with `TM_CRASH_REPORTS` suggesting a setting. The trigger and default could not be confirmed.
Impact
Crash diagnostics could be sent to Sentry without clear user notice; actual collection and transmission are unconfirmed.
Mechanism
The native binary contains a Sentry ingest URL and the crash-report setting name. No request flow or report contents were visible in the available binary analysis.
AI rationale
The native binary's Sentry endpoint and `TM_CRASH_REPORTS` string suggest crash telemetry, but the available inspection does not establish its trigger, default, or payload. This warrants a warning rather than a malicious verdict.
Evidence
.lpm-inspection-1lJcCp/5-b63aeda9c895.txtbin/tm.js
Network endpoints3
o4512288884326400.ingest.us.sentry.ioapi.teammesh.iosync.teammesh.io
Decision evidence
public snapshotAI called this Suspicious at 68.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The native binary strings include a Sentry ingest URL beside the `TM_CRASH_REPORTS` setting, indicating a crash-reporting feature.
- The binary also contains TeamMesh API and sync endpoints, consistent with the CLI's stated purpose; the extracted strings do not show when crash reports are sent or what they contain.
Evidence against
- The postinstall script stages the bundled platform binary and checks it with `--version`; the inspected script contains no download or network request.
- The readable JavaScript entry point delegates command arguments to the bundled native CLI, whose behavior is only partly inspectable from the available binary view.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgnative/win32-arm64/tm.exeView file
•path = native/win32-arm64/tm.exe
kind = native_binary
sizeBytes = 9469952
magicHex = [redacted]
Medium
Findings
1 High6 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarynative/win32-arm64/tm.exe
MediumStructural Risk Force Deep Review
MediumAi Review Evidence.lpm-inspection-1lJcCp/5-b63aeda9c895.txt
MediumAi Review Evidence.lpm-inspection-1lJcCp/5-b63aeda9c895.txt
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to teammesh@0.34.11.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.34.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.