negotium@0.1.22
Install the Negotium multi-agent runtime and CLI with one package
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
3 flagged · loading sourcedist/cron.jsView file
968async forkSession({ parentSessionId, cwd, title }) {
L969: const { forkSession } = await import("@anthropic-ai/claude-agent-sdk");
L970: const result = await forkSession(parentSessionId, {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cron.jsView on unpkg · L968dist/runtime/scripts/faster-whisper-wrapper.pyView file
•path = dist/runtime/scripts/faster-whisper-wrapper.py
kind = build_helper
sizeBytes = 2704
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkgdist/runtime/src/platform/playwright/manager.tsView file
Findings
1 High5 Medium4 Low
HighPrevious Version Dangerous Deltadist/runtime/src/platform/playwright/manager.ts
MediumDynamic Requiredist/cron.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to negotium@0.1.22.
See all versions of negotium for other recorded verdicts.
- Review the evidence and your use of negotium@0.1.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.