negotium@0.16.1
Install the Negotium multi-agent runtime and CLI with one package
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe automatic native-binary installer and AI-directed fixture create unresolved supply-chain and review-integrity risk. The code does not establish a concrete malicious chain, and the reported credential redirection was not confirmed.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation runs postinstall.
Impact
A compromised release asset or digest-bearing package update could place a native executable in the user's Negotium state directory.
Mechanism
Postinstall remote binary retrieval with later runtime execution capability.
AI rationale
The automatic native-binary installer and AI-directed fixture create unresolved supply-chain and review-integrity risk. The code does not establish a concrete malicious chain, and the reported credential redirection was not confirmed.
Evidence
package.jsoninstall-browser-rs.mjsinstall-bash-rs.mjs~/.negotium/binaries/browser-rs/v0.4.5~/.negotium/binaries/bash-rs/v0.1.10
Network endpoints1
github.com
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The install lifecycle automatically downloads executable binaries into the user's Negotium state directory.
- A shipped Codex transcript fixture contains AI-directed instruction text, which is reviewer-manipulation content even though it is not executed.
Evidence against
- The downloaded browser and shell binaries are checked against hard-coded SHA-256 digests before installation.
- The apparent DeepSeek credential behavior uses the official API endpoint; no fixed unofficial credential gateway was found.
- No self-dependency, foreign AI-agent configuration write, secret exfiltration, or hidden payload execution was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/hosted-agent.jsView file
213var TSX_BIN = resolveDependencyBin("tsx");
L214: var TSX_LOADER_PATH = createRequire(import.meta.url).resolve("tsx");
L215: var TSX_LOADER = process.platform === "win32" ? pathToFileURL(TSX_LOADER_PATH).href : TSX_LOADER_PATH;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/hosted-agent.jsView on unpkg · L213Findings
3 High6 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/mcp-factories.js
HighSemantic Analysis Limiteddist/query-runtime.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/hosted-agent.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to negotium@0.16.1.
See all versions of negotium for other recorded verdicts.
- Review the evidence and your use of negotium@0.16.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.