teammesh@0.7.0
TeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe inspected JavaScript implements a platform-specific native CLI installer and launcher, with no observed credential or network behavior. The shipped native executables remain materially unresolved, so a warning is appropriate without evidence to block publication.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation runs the postinstall hook; invoking tm launches the platform binary.
Impact
The native program runs during installation and on CLI invocation, but its effects remain unknown.
Mechanism
The hook stages and tests a native binary before replacing the JavaScript shim. The shim forwards command arguments to that binary.
AI rationale
The inspected JavaScript implements a platform-specific native CLI installer and launcher, with no observed credential or network behavior. The shipped native executables remain materially unresolved, so a warning is appropriate without evidence to block publication.
Evidence
.lpm-inspection-9WI4gV/1-644522df1327.txtinstall.jsbin/tm.jsnative/linux-arm64/tmnative/darwin-x64/tmnative/win32-x64/tm.exenative/darwin-arm64/tmnative/linux-x64/tm
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- package.json runs install.js during postinstall.
- install.js copies a platform binary, executes it with --version, and replaces bin/tm.js if it runs.
- bin/tm.js forwards CLI arguments to the native binary.
- The Linux x64 artifact analysis reports that executable behavior remains unresolved.
Evidence against
- The installer limits the replacement to npm on non-Windows platforms and removes the staged file if the check fails.
- The inspected JavaScript contains no network request or credential transfer.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg18"postinstall": "node install.js"
},
"files": [
"bin"
Medium
Suspicious Lifecycle Evidence
package.json runs install.js during postinstall.
package.jsonView on unpkg · L18native/win32-arm64/tm.exeView file
Findings
1 High8 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarynative/win32-arm64/tm.exe
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceinstall.js
MediumAi Review Evidencebin/tm.js
MediumAi Review Evidence.lpm-inspection-9WI4gV/1-644522df1327.txt
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to teammesh@0.7.0.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.