teammesh@0.8.0
⚠ Under reviewTeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe inspected JavaScript implements a platform-specific native launcher, but the bundled executables are the CLI's main runtime and their behavior remains materially unresolved. This supports manual review, not a finding of malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
An eligible npm postinstall stages and checks the matching binary; later, invoking tm runs that binary.
Impact
The native program's effects remain unknown because most platform artifacts were unsupported and the Windows x64 analysis was partial.
Mechanism
The installer replaces bin/tm.js with the native executable after its version check, and the launcher forwards command-line arguments to the native program.
AI rationale
The inspected JavaScript implements a platform-specific native launcher, but the bundled executables are the CLI's main runtime and their behavior remains materially unresolved. This supports manual review, not a finding of malicious behavior.
Evidence
.lpm-inspection-NhQUYG/0-77f2bdd1182f.txt.lpm-inspection-NhQUYG/1-c81c735b09b1.txt.lpm-inspection-NhQUYG/2-6219952131a0.txt.lpm-inspection-NhQUYG/3-b20bd921d557.txt.lpm-inspection-NhQUYG/4-ce78a0039dc3.txt.lpm-inspection-NhQUYG/5-a0741675af9e.txtpackage.jsoninstall.jsbin/tm.jsnative/win32-arm64/tm.exenative/linux-arm64/tmnative/darwin-x64/tmnative/win32-x64/tm.exenative/darwin-arm64/tmnative/linux-x64/tm
Decision evidence
public snapshotAI called this Manual Review at 94.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest defines a postinstall hook and maps the tm command to a JavaScript launcher.
- On eligible npm installs, install.js selects and stages the platform binary, runs it with --version, then replaces the launcher if that succeeds.
- The launcher passes tm arguments directly to the platform-specific native binary.
- Host analysis could not inspect most native binaries and reports uninspected call targets in the Windows x64 binary; their runtime behavior remains unresolved.
Evidence against
- The installer skips Windows and non-npm installs, and removes the staged file if replacement fails.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg14"bin": {
"tm": "bin/tm.js"
},
"scripts": {
"postinstall": "node install.js"
},
"files": [
"bin",
"native",
"install.js",
"LICE
Low
Suspicious Lifecycle Evidence
The manifest defines a postinstall hook and maps the tm command to a JavaScript launcher.
package.jsonView on unpkg · L14native/win32-arm64/tm.exeView file
Findings
1 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binarynative/win32-arm64/tm.exe
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceinstall.js
LowAi Review Evidenceinstall.js
LowAi Review Evidencebin/tm.js
Affected versions and remediation
This report applies to teammesh@0.8.0.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.