registry / Remote code execution / negotium / 0.2.13

negotium@0.2.13

Install the Negotium multi-agent runtime and CLI with one package

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source establishes a real high-impact agent shell capability and install-time native payload delivery, warranting a warning. It does not establish malicious intent or a concrete unconsented attack chain.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall; later Negotium runtime/MCP tool use

Impact

A compromised or unsafe agent session could execute commands with the runtime user's privileges.

Mechanism

verified native-binary staging plus agent-accessible shell execution

AI rationale

Evidence

package.jsoninstall-browser-rs.mjsinstall-bash-rs.mjsdist/runtime/src/mcp/background-bash-server.tsdist/mcp-factories.jsdist/runtime/src/platform/mcp-config.ts

Network endpoints3

github.com/maestrojeong/browser-rs-mcp/releases/download/v0.1.19github.com/maestrojeong/bash-rs-mcp/releases/download/v0.1.2127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs two postinstall scripts.
install-browser-rs.mjs downloads and installs an executable to ~/.negotium.
install-bash-rs.mjs downloads and installs an executable to ~/.negotium.
dist/runtime/src/mcp/background-bash-server.ts executes bash -c commands.
dist/mcp-factories.js provides a vault-backed shell-command facility.

Evidence against

Postinstall downloads use fixed GitHub release URLs and SHA-256 verification.
No source evidence of credential exfiltration or arbitrary external endpoint.
Runtime MCP endpoints shown are loopback-only and capability-checked.
No install-time AI-agent configuration mutation found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

9 flagged

package.jsonView file

Lines 113-153json

113 ],

114 "engines": {

115 "bun": ">=1.2.15"

116 },

117 "repository": {

118 "type": "git",

119 "url": "git+https://github.com/maestrojeong/negotium.git",

120 "directory": "apps/negotium"

121 },

122 "homepage": "https://github.com/maestrojeong/negotium#readme",

123 "bugs": {

124 "url": "https://github.com/maestrojeong/negotium/issues"

125 },

126 "publishConfig": {

127 "access": "public"

128 },

129 "scripts": {

130 "build": "bun ../../scripts/build-negotium-package.ts",

131 "check": "bunx tsc --noEmit",

132 "lint": "biome check",

133 "postinstall": "node install-browser-rs.mjs && node install-bash-rs.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L133

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L133

134 "prepack": "bun run build"

135 },

136 "dependencies": {

137 "@anthropic-ai/claude-agent-sdk": "^0.3.220",

138 "@anthropic-ai/sdk": "^0.111.0",

139 "@modelcontextprotocol/sdk": "^1.29.0",

140 "@openai/codex-sdk": "0.146.0",

141 "diff": "^9.0.0",

142 "maestro-agent-sdk": "0.2.2",

143 "node-telegram-bot-api": "^1.1.2",

144 "orchgraph": "0.2.0",

145 "pino": "^10.3.1",

146 "pino-pretty": "^13.1.3",

147 "tsx": "^4.22.4",

148 "zod": "^4.3.6"

149 },

150 "devDependencies": {

151 "@types/node": "^20",

152 "bun-types": "^1.3.11",

153 "typescript": "^5"

dist/hosted-agent.jsView file

Lines 1-28javascript

1// @bun

2import {

3 __require,

4 canonicalMcpBridgeEnv,

5 revokeCanonicalMcpBridgeTurn

6} from "./chunk-r0xs3t81.js";

8// ../../packages/core/src/agents/claude-provider.ts

9import { spawn as spawn2 }

dist/runtime/src/mcp/background-bash-server.tsView file

Lines 489-529typescript

489

490// --- MCP tool factory (shared registry via closure, one instance per connection) ---

491

492function buildMcpServer(context: BgContext): McpServer {

493 const server =

dist/mcp-factories.jsView file

2940// ../../packages/core/src/agents/codex-app-server.ts L2941: import { spawn as spawn4 } from "child_process"; L2942: function createCodexAppServerForker(host) { ... L2944: const child = host.spawnServer(); L2945: return await new Promise((resolve6, reject) => { L2946: let settled = false; L2947: let stdoutBuffer = ""; L2948: let stderr = ""; ... L2955: try { L2956: child.stdin.end(); L2957: child.kill();

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-factories.jsView on unpkg · L2940

2940Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/mcp-factories.js L2940: // ../../packages/core/src/agents/codex-app-server.ts L2941: import { spawn as spawn4 } from "child_process"; L2942: function createCodexAppServerForker(host) { ... L2944: const child = host.spawnServer(); L2945: return await new Promise((resolve6, reject) => { L2946: let settled = false; L2947: let stdoutBuffer = ""; L2948: let stderr = ""; ... L2955: try { L2956: child.stdin.end(); L2957: child.kill();

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/mcp-factories.jsView on unpkg · L2940

dist/runtime/scripts/faster-whisper-wrapper.pyView file

•path = dist/runtime/scripts/faster-whisper-wrapper.py kind = build_helper sizeBytes = 2704 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkg

dist/agent-helpers.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = negotium@0.1.32 matchedIdentity = npm:bmVnb3RpdW0:0.1.32 similarity = 0.392 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent-helpers.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/hosted-agent.jsView file

8// ../../packages/core/src/agents/claude-provider.ts L9: import { spawn as spawn2 } from "child_process"; L10: import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";

High

Child Process

Package source references child process execution.

dist/hosted-agent.jsView on unpkg · L8

Findings

1 Critical5 High6 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/agent-helpers.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/hosted-agent.js

HighShelldist/runtime/src/mcp/background-bash-server.ts

HighCommand Output Exfiltrationdist/mcp-factories.js

HighTrigger Reachable Command Output Exfiltrationdist/mcp-factories.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/hosted-agent.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to negotium@0.2.13.

See all versions of negotium for other recorded verdicts.

Review the evidence and your use of negotium@0.2.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-09 22:04:39.466Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.