teammesh@0.43.1
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe native binary appears to have runtime crash reporting to Sentry, but the available analysis cannot establish its default behavior or payload. Treat this as a telemetry risk and warn pending fuller inspection.
Static reason
One or more suspicious static signals were detected.
Trigger
Potentially when the native CLI handles a crash; the binary view does not establish the trigger or default setting.
Impact
Crash diagnostics may be sent to Sentry; the payload and whether this occurs without user action could not be established.
Mechanism
A Sentry ingest URL appears in native binary strings alongside the crash-reporting flag.
AI rationale
The native binary appears to have runtime crash reporting to Sentry, but the available analysis cannot establish its default behavior or payload. Treat this as a telemetry risk and warn pending fuller inspection.
Evidence
native/win32-x64/tm.exe.lpm-inspection-eFo1zE/5-2d65c1f6ac39.txt
Network endpoints1
o4512288884326400.ingest.us.sentry.io/4512288887013376
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The native binary strings contain a Sentry ingest URL adjacent to the TM_CRASH_REPORTS flag, suggesting a crash-reporting feature.
- The offline analysis could not inspect all native call targets, so it does not establish whether reporting is enabled by default or what data it sends.
- The postinstall script stages the bundled platform binary and invokes it only with --version before replacing the CLI shim.
Evidence against
- The manifest describes a TeamMesh CLI and maps its command to bin/tm.js.
- The JavaScript shim selects the bundled platform binary and forwards the user's command-line arguments to it.
- No credential collection or unrelated collector behavior was established from the readable source.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgnative/win32-arm64/tm.exeView file
•path = native/win32-arm64/tm.exe
kind = native_binary
sizeBytes = 9705472
magicHex = [redacted]
Medium
Findings
1 High7 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarynative/win32-arm64/tm.exe
MediumStructural Risk Force Deep Review
MediumAi Review Evidence.lpm-inspection-eFo1zE/5-2d65c1f6ac39.txt
MediumAi Review Evidence.lpm-inspection-eFo1zE/5-2d65c1f6ac39.txt
MediumSuspicious Lifecycle Evidenceinstall.js
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to teammesh@0.43.1.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.43.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.