teammesh@0.48.0
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 20h ago · by lpm-firewall-aiThe postinstall behavior is a platform-specific CLI shim replacement, and the JavaScript entry point simply forwards user arguments to the bundled binary. The available binary strings are consistent with TeamMesh services, though limited analysis cannot determine whether Sentry crash reporting is enabled by default; no concrete attack behavior was found.
Decision evidence
public snapshot- The postinstall hook selects a bundled binary for the current platform and replaces the CLI shim only if that binary runs successfully.
- The bin entry forwards the user's command arguments to the bundled native CLI.
- The native binary's readable strings name TeamMesh API and sync endpoints, consistent with the package's team collaboration CLI purpose.
- The binary strings include a Sentry crash-reporting endpoint and a TM_CRASH_REPORTS flag; the available analysis does not establish whether reporting is enabled by default.
- The manifest declares a postinstall script, so installation does execute package code.
- The postinstall hook also invokes the installed CLI with a pools-upgrade diagnostic command.
- The supplied analysis of the Windows binary is limited and does not establish its complete behavior.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall hook selects a bundled binary for the current platform and replaces the CLI shim only if that binary runs successfully.
package.jsonView on unpkg · L14Findings
Affected versions and remediation
This report applies to teammesh@0.48.0.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.48.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.