teammesh@0.43.2
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe install hook’s readable behavior is limited to a platform-specific shim replacement after a successful version check, with a conditional upgrade notice. The bundled native CLI is only partially inspectable, but the available evidence does not establish malicious behavior and its service host strings fit the package’s stated purpose.
Decision evidence
public snapshot- The postinstall hook runs only on non-Windows npm installs and selects a binary matching the platform and architecture.
- The hook copies that binary over the CLI shim only after it runs successfully with --version; failures leave the shim in place.
- The CLI shim forwards arguments to the matching bundled native binary.
- The native binary report contains TeamMesh API and sync host strings, consistent with the package’s stated team-connection CLI purpose.
- The native binaries are not fully inspectable in the available offline reports, so their runtime behavior cannot be confirmed from source.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall hook runs only on non-Windows npm installs and selects a binary matching the platform and architecture.
package.jsonView on unpkg · L14Findings
Affected versions and remediation
This report applies to teammesh@0.43.2.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.43.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.