teammesh@0.34.2
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe bundled native binary contains a Sentry ingest URL beside a crash-reporting environment marker, but the analysis cannot establish the default behavior or payload. This is a telemetry concern rather than evidence of data theft or other malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Unknown; potentially when the native CLI runs.
Impact
Potential transmission of crash data to Sentry; the data collected and whether reporting can be disabled are unverified.
Mechanism
The Windows binary contains a Sentry ingest URL and a TM_CRASH_REPORTS marker, but the analysis does not reveal the reporting code or its default setting.
AI rationale
The bundled native binary contains a Sentry ingest URL beside a crash-reporting environment marker, but the analysis cannot establish the default behavior or payload. This is a telemetry concern rather than evidence of data theft or other malicious behavior.
Evidence
.lpm-inspection-KaCK5v/5-f4899485cccd.txtinstall.jsbin/tm.js.nativebin/tm.js
Network endpoints3
o4512288884326400.ingest.us.sentry.ioapi.teammesh.iosync.teammesh.io
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Windows native binary analysis view contains a Sentry ingest URL immediately followed by the TM_CRASH_REPORTS marker, suggesting crash reporting.
- The analysis reports that native call-graph targets remain uninspected, so it does not establish whether reporting is enabled by default or what data it sends.
Evidence against
- The postinstall helper stages a bundled platform binary, checks it with --version, and replaces the CLI shim; it shows no network request.
- The package describes a TeamMesh CLI, and the binary strings include TeamMesh API and sync endpoints consistent with that purpose.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgnative/win32-arm64/tm.exeView file
•path = native/win32-arm64/tm.exe
kind = native_binary
sizeBytes = 9452544
magicHex = [redacted]
Medium
Findings
1 High6 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarynative/win32-arm64/tm.exe
MediumStructural Risk Force Deep Review
MediumAi Review Evidence.lpm-inspection-KaCK5v/5-f4899485cccd.txt
MediumAi Review Evidence.lpm-inspection-KaCK5v/5-f4899485cccd.txt
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to teammesh@0.34.2.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.34.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.