teammesh@0.5.0
⚠ Under reviewTeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe JavaScript source shows a native CLI installation and launch path, while the available binary analysis is incomplete or unsupported. Because the native behavior remains materially unresolved, manual review is appropriate; the inspected evidence does not establish a specific attack.
Decision evidence
public snapshot- The manifest runs install.js during postinstall and ships the CLI and native binaries.
- On supported npm installs, install.js replaces the JavaScript launcher with the matching native binary after checking its version.
- The launcher runs the platform binary with the caller's arguments.
- The available native analyses leave behavior unresolved; the Windows analysis notes uninspected call targets, and the Linux binary is unrecognized.
- The Windows binary analysis contains a reference to api.teammesh.io, but does not establish when or how it is contacted.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe manifest runs install.js during postinstall and ships the CLI and native binaries.
package.jsonView on unpkg · L17Findings
Affected versions and remediation
This report applies to teammesh@0.5.0.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.