registry / Staged payload carrier / negotium / 0.16.0

negotium@0.16.0

Install the Negotium multi-agent runtime and CLI with one package

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No source evidence establishes credential theft, agent-control hijacking, destructive behavior, or a self-dependency chain. Automatic download of opaque executables during postinstall remains a real supply-chain risk that warrants a warning.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall; using the background-shell feature starts the bash binary.

Impact

A pinned but uninspectable executable is written to the user's package-specific state directory and can run with that user's permissions.

Mechanism

Postinstall native-binary download and later child-process launch.

AI rationale

Evidence

package.jsoninstall-browser-rs.mjsinstall-bash-rs.mjsdist/background-bash.js.negotium/binaries/browser-rs/v0.4.5/browser-rs.negotium/binaries/bash-rs/v0.1.10/bash-rs

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The npm postinstall hook automatically runs two native-binary installers.
Both installers download opaque platform executables, make them executable, and place them in the user's Negotium state directory.
The runtime later starts the downloaded bash executable as a child process.

Evidence against

The installers pin SHA-256 hashes and reject a downloaded file whose hash differs.
The install hook writes only under the package-specific Negotium state directory; no foreign agent configuration write was found.
The DeepSeek request uses an explicit configured key and its documented default endpoint; no fixed unofficial credential gateway was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

7 flagged

package.jsonView file

Lines 123-163json

123 ],

124 "engines": {

125 "bun": ">=1.2.15"

126 },

127 "repository": {

128 "type": "git",

129 "url": "git+https://github.com/maestrojeong/negotium.git",

130 "directory": "apps/negotium"

131 },

132 "homepage": "https://github.com/maestrojeong/negotium#readme",

133 "bugs": {

134 "url": "https://github.com/maestrojeong/negotium/issues"

135 },

136 "publishConfig": {

137 "access": "public"

138 },

139 "scripts": {

140 "build": "bun ../../scripts/build-negotium-package.ts",

141 "check": "bunx tsc --noEmit",

142 "lint": "biome check",

143 "postinstall": "node install-browser-rs.mjs && node install-bash-rs.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L143

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L143

144 "prepack": "bun run build"

145 },

146 "dependencies": {

147 "@anthropic-ai/claude-agent-sdk": "^0.3.261",

148 "@anthropic-ai/sdk": "^0.124.0",

149 "@modelcontextprotocol/sdk": "^1.30.0",

150 "@openai/codex-sdk": "^0.153.4",

151 "diff": "^9.0.0",

152 "maestro-agent-sdk": "0.5.1",

153 "node-telegram-bot-api": "^1.1.2",

154 "orchgraph": "0.2.4",

155 "pino": "^10.3.1",

156 "pino-pretty": "^13.1.3",

157 "tsx": "^4.23.13",

158 "zod": "4.4.3"

159 },

160 "devDependencies": {

161 "@types/node": "^26.4.1",

162 "bun-types": "^1.4.2",

163 "typescript": "^5"

dist/hosted-agent.jsView file

Lines 193-233javascript

193var BROWSER_RS_BIN = resolveBrowserRsBin(envText("NEGOTIUM_BROWSER_RS_BIN"));

194var BASH_RS_VERSION = "v0.1.10";

195function resolveBashRsBin(envValue

dist/mcp-factories.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/mcp-factories.js: writeFileSync writeFileSync(secretFile, `${envValue} writeFileSync(secretFile, `${secret} return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json"); writeFileSync as writeFileSync3 writeFileSync3(fd, payload); import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs"; const projectsDir = join3(homedir2(), ".claude", "projects", encodeClaudeCwd(opts.cwd));

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/mcp-factories.jsView on unpkg

dist/runtime/scripts/faster-whisper-wrapper.pyView file

•path = dist/runtime/scripts/faster-whisper-wrapper.py kind = build_helper sizeBytes = 2704 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkg

dist/query-runtime.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/query-runtime.js#virtual:normalized:round1View on unpkg

dist/background-bash.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = negotium@0.15.1 matchedIdentity = npm:bmVnb3RpdW0:0.15.1 similarity = 0.725 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/background-bash.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/hosted-agent.jsView file

213var TSX_BIN = resolveDependencyBin("tsx"); L214: var TSX_LOADER_PATH = createRequire(import.meta.url).resolve("tsx"); L215: var TSX_LOADER = process.platform === "win32" ? pathToFileURL(TSX_LOADER_PATH).href : TSX_LOADER_PATH;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hosted-agent.jsView on unpkg · L213

Findings

4 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/mcp-factories.js

HighSemantic Analysis Limiteddist/query-runtime.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/background-bash.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/hosted-agent.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Low

Affected versions and remediation

This report applies to negotium@0.16.0.

See all versions of negotium for other recorded verdicts.

Review the evidence and your use of negotium@0.16.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 12:47:03.526Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.