teammesh@0.4.0
⚠ Under reviewTeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe JavaScript installer and shim show how the native CLI is selected and launched, but static analysis could not resolve most bundled executables and left Windows x64 call targets uninspected. Because those binaries are the package’s runtime, the available source does not establish whether the package is malicious or clean.
Decision evidence
public snapshot- The postinstall hook runs install.js, which can replace the CLI shim with a packaged native binary.
- The CLI shim forwards its arguments to the platform’s native binary.
- The native binaries are the CLI’s runtime, but offline analysis could not resolve behavior for most platforms and left uninspected call targets on Windows x64.
- The installer limits replacement to a matching binary that runs with --version; its comments describe a startup-performance purpose.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall hook runs install.js, which can replace the CLI shim with a packaged native binary.
package.jsonView on unpkg · L18Findings
Affected versions and remediation
This report applies to teammesh@0.4.0.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.