teammesh@0.8.1
⚠ Under reviewTeamMesh CLI: connects AI coding agents to your team
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe inspected JavaScript shows a platform-specific installer and launcher, but does not establish an attack. Because the launched native binaries have material unresolved analysis limits, their behavior cannot be cleared or classified from the available source evidence.
Decision evidence
public snapshot- The package runs install.js during postinstall, with platform and package-manager checks before selecting a binary.
- The install hook copies the selected binary, runs it with --version, then replaces bin/tm.js; the CLI launches that native binary on invocation.
- Offline reports leave the Linux and macOS binaries unrecognized and the Windows ARM64 binary unsupported.
- The Windows x64 report says disassembly exceeded its output limit and native call targets remain uninspected.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package runs install.js during postinstall, with platform and package-manager checks before selecting a binary.
package.jsonView on unpkg · L17Findings
Affected versions and remediation
This report applies to teammesh@0.8.1.
See all versions of teammesh for other recorded verdicts.
- Review the evidence and your use of teammesh@0.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.