teammesh@0.36.2
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe postinstall and launcher behavior is consistent with installing and running the bundled TeamMesh CLI, with no evidence of unrelated data collection or other attack behavior. A Sentry endpoint and `TM_CRASH_REPORTS` marker appear in the available Windows binary strings, but those strings do not establish automatic reporting or its contents.
Decision evidence
public snapshot- The manifest describes TeamMesh as a CLI that connects AI coding agents to the TeamMesh service and declares `bin/tm.js` as its command.
- The postinstall hook uses a bundled platform binary, checks that it runs with `--version`, then replaces the JavaScript shim; it does not download or transmit data.
- The shim launches the matching local native binary with the user's command-line arguments.
- The available native analysis shows TeamMesh API and sync hosts, consistent with the package's stated service purpose.
- The package runs a postinstall hook and ships native binaries.
- The Windows x64 binary analysis contains a Sentry endpoint and `TM_CRASH_REPORTS`; the available strings do not establish whether reports are sent by default or what they contain.
- Native analysis is limited or unavailable for several platform binaries.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe manifest describes TeamMesh as a CLI that connects AI coding agents to the TeamMesh service and declares `bin/tm.js` as its command.
package.jsonView on unpkg · L14Findings
Affected versions and remediation
This report applies to teammesh@0.36.2.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.36.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.