negotium@0.1.21
Install the Negotium multi-agent runtime and CLI with one package
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is not malicious by source evidence, but it ships a high-impact AI-agent execution surface. Its lack of lifecycle hooks and absence of covert credential collection or exfiltration rule out a publish block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User starts the CLI/runtime and configures or invokes its MCP, vault, cron, or adapter features.
Impact
Configured agents can run commands and use configured credentials; cron summaries may transmit supplied prompt text to the configured API.
Mechanism
User-mediated agent orchestration and shell execution
AI rationale
The package is not malicious by source evidence, but it ships a high-impact AI-agent execution surface. Its lack of lifecycle hooks and absence of covert credential collection or exfiltration rule out a publish block.
Evidence
package.jsondist/main.jsdist/cron.jsdist/runtime/src/mcp/background-bash-server.tsdist/runtime/src/mcp/vault-run.tsdist/runtime/src/mcp/session-comm/peer-forward.tsREADME.mddist/runtime/src/platform/config.tsdist/runtime/cron/scripts.ts
Network endpoints1
api.deepseek.com/v1/chat/completions
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Benign with low false-positive risk.
Evidence for warning
- dist/runtime/src/mcp/background-bash-server.ts exposes an MCP tool that runs bash -c commands.
- dist/runtime/src/mcp/vault-run.ts substitutes vault values into shell commands.
- dist/main.js permits explicit `mcp add` command specifications.
- dist/cron.js can send cron prompt text to api.deepseek.com when configured.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- dist/main.js dispatches behavior only after explicit CLI commands.
- dist/main.js auth check only tests credential-file existence; it does not read credential values.
- Peer bridge source restricts fallback forwarding to loopback hosts.
- No stealth exfiltration, remote payload download, or foreign agent-config mutation found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
3 flagged · loading sourcedist/cron.jsView file
968async forkSession({ parentSessionId, cwd, title }) {
L969: const { forkSession } = await import("@anthropic-ai/claude-agent-sdk");
L970: const result = await forkSession(parentSessionId, {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cron.jsView on unpkg · L968dist/runtime/scripts/faster-whisper-wrapper.pyView file
•path = dist/runtime/scripts/faster-whisper-wrapper.py
kind = build_helper
sizeBytes = 2704
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkgdist/hosted-agent.jsView file
Findings
1 High5 Medium4 Low
HighPrevious Version Dangerous Deltadist/hosted-agent.js
MediumDynamic Requiredist/cron.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to negotium@0.1.21.
See all versions of negotium for other recorded verdicts.
- Review the evidence and your use of negotium@0.1.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.