registry / negotium / 0.18.2

negotium@0.18.2

Install the Negotium multi-agent runtime and CLI with one package

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Source inspection did not confirm the scanner’s credential-redirection claim: the inspected authentication helper only resolves the Codex auth-file location. The postinstall downloads companion binaries from project release URLs with pinned hashes, and inspected agent-related writes support session handling rather than broad configuration mutation.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Package installation triggers the postinstall script; agent and browser behaviors require their runtime features to be invoked.

Impact

No credential theft, broad agent control-surface mutation, or other confirmed attack impact was established.

Mechanism

The installers retrieve fixed-release binaries and verify their hashes before placing them in the Negotium state directory. Inspected runtime excerpts resolve a Codex auth-file path, write Claude rollout data, and call a localhost browser service.

AI rationale

Evidence

install-browser-rs.mjsinstall-bash-rs.mjsdist/mcp-factories.jsdist/chunk-q2s5f70x.jsdist/registry.jsdist/browser-runtime.js

Network endpoints1

github.com/maestrojeong/browser-rs-mcp/releases/download/

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes the CLI and runtime modules; its postinstall invokes two package-owned binary installers.
Both installers fetch versioned binaries from the project’s GitHub releases and verify them against platform-specific SHA-256 digests before replacing files under the Negotium state directory.
The inspected Codex authentication path resolves to the user’s Codex auth file; the surrounding source shows no credential forwarding to an unrelated gateway.
Claude rollout helpers write generated session data beneath Claude’s project directory, while the browser runtime’s inspected request targets a local service and includes its capability header.
The inspected query-runtime entry begins with logger setup; no malicious behavior was established from that excerpt.

Evidence against

The postinstall performs network downloads and writes executable files, but the inspected installer code limits this to versioned, hash-verified companion binaries in Negotium’s own state directory.
Agent-related paths inspected refer to authentication-file resolution and session rollout handling; no unconsented broad agent configuration mutation was established.

Source & flagged code

7 flagged

package.jsonView file

Lines 124-164json

124 ],

125 "engines": {

126 "bun": ">=1.2.15"

127 },

128 "repository": {

129 "type": "git",

130 "url": "git+https://github.com/maestrojeong/negotium.git",

131 "directory": "apps/negotium"

132 },

133 "homepage": "https://github.com/maestrojeong/negotium#readme",

134 "bugs": {

135 "url": "https://github.com/maestrojeong/negotium/issues"

136 },

137 "publishConfig": {

138 "access": "public"

139 },

140 "scripts": {

141 "build": "bun ../../scripts/build-negotium-package.ts",

142 "check": "bunx tsc --noEmit",

143 "lint": "biome check",

144 "postinstall": "node install-browser-rs.mjs && node install-bash-rs.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L144

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L144

145 "prepack": "bun run build"

146 },

147 "dependencies": {

148 "@anthropic-ai/claude-agent-sdk": "^0.3.261",

149 "@anthropic-ai/sdk": "^0.124.0",

150 "@modelcontextprotocol/sdk": "^1.30.0",

151 "@openai/codex-sdk": "^0.153.4",

152 "diff": "^9.0.0",

153 "maestro-agent-sdk": "0.5.1",

154 "node-telegram-bot-api": "^1.1.2",

155 "orchgraph": "0.2.4",

156 "pino": "^10.3.1",

157 "pino-pretty": "^13.1.3",

158 "tsx": "^4.23.13",

159 "zod": "4.4.3"

160 },

161 "devDependencies": {

162 "@types/node": "^26.4.1",

163 "bun-types": "^1.4.2",

164 "typescript": "^5"

dist/hosted-agent.jsView file

Lines 192-232javascript

192var BROWSER_RS_BIN = resolveBrowserRsBin(envText("NEGOTIUM_BROWSER_RS_BIN"));

193var BASH_RS_VERSION = "v0.1.10";

194function resolveBashRsBin(envValue

dist/mcp-factories.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/mcp-factories.js: writeFileSync writeFileSync(secretFile, `${envValue} writeFileSync(secretFile, `${secret} return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json"); writeFileSync as writeFileSync3 writeFileSync3(fd, payload); import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs"; const projectsDir = join3(homedir2(), ".claude", "projects", encodeClaudeCwd(opts.cwd));

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/mcp-factories.jsView on unpkg

dist/runtime/scripts/faster-whisper-wrapper.pyView file

•path = dist/runtime/scripts/faster-whisper-wrapper.py kind = build_helper sizeBytes = 2704 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkg

dist/query-runtime.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/query-runtime.js#virtual:normalized:round1View on unpkg

dist/browser-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = negotium@0.16.1 matchedIdentity = npm:bmVnb3RpdW0:0.16.1 similarity = 0.825 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/browser-runtime.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/hosted-agent.jsView file

212var TSX_BIN = resolveDependencyBin("tsx"); L213: var TSX_LOADER_PATH = createRequire(import.meta.url).resolve("tsx"); L214: var TSX_LOADER = process.platform === "win32" ? pathToFileURL(TSX_LOADER_PATH).href : TSX_LOADER_PATH;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hosted-agent.jsView on unpkg · L212

Findings

4 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/mcp-factories.js

HighSemantic Analysis Limiteddist/query-runtime.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/browser-runtime.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/hosted-agent.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Low

Affected versions and remediation

This report applies to negotium@0.18.2.

See all versions of negotium for other recorded verdicts.

Review the evidence and your use of negotium@0.18.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 08:53:52.186Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code