negotium@0.1.16
Install the Negotium multi-agent runtime and CLI with one package
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo concrete covert exfiltration, lifecycle execution, or foreign AI-agent configuration hijack was found. The package nevertheless ships a persistent arbitrary-shell capability reachable by its agent runtime, so it warrants a warning rather than a clean verdict.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User starts the Negotium runtime and an authorized agent invokes `background_bash_run`.
Impact
Prompt or agent compromise can execute commands, access inherited environment variables, and modify accessible local files.
Mechanism
Authenticated MCP-to-`bash -c` persistent command execution.
AI rationale
No concrete covert exfiltration, lifecycle execution, or foreign AI-agent configuration hijack was found. The package nevertheless ships a persistent arbitrary-shell capability reachable by its agent runtime, so it warrants a warning rather than a clean verdict.
Evidence
package.jsonREADME.mddist/main.jsdist/cron.jsdist/runtime/src/mcp/background-bash-server.tsdist/runtime/src/platform/mcp-config.ts
Network endpoints3
api.deepseek.com/v1/chat/completions127.0.0.1:${port}/mcp127.0.0.1:${port}/sse
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- `dist/runtime/src/mcp/background-bash-server.ts` executes MCP-supplied strings with `bash -c`.
- The background shell inherits `process.env` and accepts an optional arbitrary `cwd`.
- Background commands are detached and persist beyond an agent turn; output is injected into a session inbox.
- `dist/cron.js` includes a configurable DeepSeek completion endpoint.
Evidence against
- `package.json` has no preinstall, install, or postinstall lifecycle hook.
- `dist/main.js` dispatches runtime actions only through explicit CLI commands such as `init` and `serve`.
- Background-bash startup requires per-runtime capability values and exposes local HTTP MCP endpoints.
- No inspected source writes foreign Codex/Claude MCP configuration or sends credentials to an untrusted endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flagged · loading sourcedist/cron.jsView file
283// ../../packages/core/src/agents/codex-tree-kill.ts
L284: import { execFileSync } from "child_process";
L285: function getDirectChildren(parentPid) {
High
2068try {
L2069: const res = await fetch(`http://127.0.0.1:${port}/health`, {
L2070: signal: AbortSignal.timeout(2000)
...
L2079: const serverArgs = ["run", BACKGROUND_BASH_SERVER, `--port=${port}`];
L2080: const proc = spawn("bun", serverArgs, {
L2081: stdio: "ignore",
...
L2083: env: {
L2084: ...process.env,
L2085: NEGOTIUM_BG_BASH_CAPABILITY: runtimeCapability,
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cron.jsView on unpkg · L2068885async forkSession({ parentSessionId, cwd, title }) {
L886: const { forkSession } = await import("@anthropic-ai/claude-agent-sdk");
L887: const result = await forkSession(parentSessionId, {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cron.jsView on unpkg · L885Findings
4 High5 Medium4 Low
HighChild Processdist/cron.js
HighShelldist/runtime/src/mcp/background-bash-server.ts
HighSame File Env Network Executiondist/cron.js
HighPrevious Version Dangerous Deltadist/hosted-agent.js
MediumDynamic Requiredist/cron.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to negotium@0.1.16.
See all versions of negotium for other recorded verdicts.
- Review the evidence and your use of negotium@0.1.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.