teammesh@0.34.8
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe postinstall behavior is limited to validating and installing the package's own platform-specific CLI binary, and the launcher runs that binary with the user's arguments. The available evidence does not establish malicious behavior; the native analysis is incomplete and includes a Sentry string whose use could not be confirmed.
Decision evidence
public snapshot- The package is described as a TeamMesh CLI and exposes the `tm` command through `bin/tm.js`.
- Postinstall only stages the matching bundled binary for npm on supported non-Windows platforms, checks it with `--version`, and replaces the shim; no network or project-data collection appears in the script.
- The launcher invokes the matching bundled native binary with the user's arguments.
- The binary analysis lists TeamMesh API and sync hosts, consistent with the package's stated purpose.
- The native executable analysis is limited and does not establish all runtime behavior.
- The Windows x64 binary string table contains a Sentry endpoint and `TM_CRASH_REPORTS`; the strings alone do not establish what is sent or when.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package is described as a TeamMesh CLI and exposes the `tm` command through `bin/tm.js`.
package.jsonView on unpkg · L14Findings
Affected versions and remediation
This report applies to teammesh@0.34.8.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.34.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.