negotium@0.2.28
Install the Negotium multi-agent runtime and CLI with one package
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not concrete malicious behavior, but it delivers high-impact AI-agent and shell/browser capability plus install-time native binary retrieval. It merits a warning for dangerous capability rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm postinstall; later explicit negotium CLI/runtime commands
Impact
A user installing or operating the package grants its intended browser, shell, and AI-agent capabilities.
Mechanism
verified native-binary bootstrap and full-access agent orchestration
AI rationale
This is not concrete malicious behavior, but it delivers high-impact AI-agent and shell/browser capability plus install-time native binary retrieval. It merits a warning for dangerous capability rather than a block.
Evidence
package.jsoninstall-browser-rs.mjsinstall-bash-rs.mjsdist/runtime/src/agents/codex-provider.tsdist/runtime/cron/summarize.tsdist/main.js
Network endpoints3
github.com/maestrojeong/browser-rs-mcp/releases/download/v0.1.19github.com/maestrojeong/bash-rs-mcp/releases/download/v0.1.5api.deepseek.com/v1/chat/completions
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- package.json runs postinstall scripts.
- install-browser-rs.mjs downloads and executes a checksum-pinned Browser.rs binary.
- install-bash-rs.mjs downloads a checksum-pinned bash-rs binary.
- dist/runtime/src/agents/codex-provider.ts starts agents with danger-full-access and approvalPolicy never.
- dist/runtime/cron/summarize.ts sends scheduled prompts to DeepSeek when configured.
Evidence against
- Lifecycle downloads use fixed GitHub release URLs and SHA-256 verification.
- Installers write only Negotium-owned ~/.negotium binary paths.
- No lifecycle mutation of Codex, Claude, or other foreign agent configuration was found.
- CLI runtime behavior is activated through explicit negotium commands; no import-time agent execution found.
- No covert credential harvesting or unrelated exfiltration endpoint was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/hosted-agent.jsView file
9// ../../packages/core/src/agents/claude-provider.ts
L10: import { spawn as spawn2 } from "child_process";
L11: import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
High
Child Process
Package source references child process execution.
dist/hosted-agent.jsView on unpkg · L9192var TSX_BIN = resolveDependencyBin("tsx");
L193: var TSX_LOADER = createRequire(import.meta.url).resolve("tsx");
L194: var TSCONFIG_PATH = resolve(PROJECT_ROOT, "tsconfig.json");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/hosted-agent.jsView on unpkg · L192dist/main.jsView file
1941async function bootstrapCodexModelCache(codexHome, cachePath) {
L1942: const child = spawn(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], {
L1943: env: { ...process.env, CODEX_HOME: codexHome },
L1944: stdio: ["pipe", "pipe", "pipe"]
L1945: });
L1946: await new Promise((resolve4, reject) => {
L1947: let settled = false;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/main.jsView on unpkg · L19411941async function bootstrapCodexModelCache(codexHome, cachePath) {
L1942: const child = spawn(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], {
L1943: env: { ...process.env, CODEX_HOME: codexHome },
...
L1945: });
L1946: await new Promise((resolve4, reject) => {
L1947: let settled = false;
L1948: let stdoutBuffer = "";
L1949: let stderr = "";
...
L1956: try {
L1957: child.stdin.end();
L1958: child.kill();
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/main.jsView on unpkg · L1941dist/agent-helpers.jsView file
3164Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/agent-helpers.js
L3164: // ../../packages/core/src/agents/codex-app-server.ts
L3165: import { spawn as spawn3 } from "child_process";
L3166: function createCodexAppServerForker(host) {
...
L3168: const child = host.spawnServer();
L3169: return await new Promise((resolve6, reject) => {
L3170: let settled = false;
L3171: let stdoutBuffer = "";
L3172: let stderr = "";
...
L3179: try {
L3180: child.stdin.end();
L3181: child.kill();
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/agent-helpers.jsView on unpkg · L3164dist/runtime/scripts/faster-whisper-wrapper.pyView file
•path = dist/runtime/scripts/faster-whisper-wrapper.py
kind = build_helper
sizeBytes = 2704
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkgdist/browser-runtime.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = negotium@0.1.32
matchedIdentity = npm:bmVnb3RpdW0:0.1.32
similarity = 0.367
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/browser-runtime.jsView on unpkgFindings
1 Critical6 High6 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/browser-runtime.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/hosted-agent.js
HighShell
HighSame File Env Network Executiondist/main.js
HighCommand Output Exfiltrationdist/main.js
HighTrigger Reachable Command Output Exfiltrationdist/agent-helpers.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/hosted-agent.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to negotium@0.2.28.
See all versions of negotium for other recorded verdicts.
- Review the evidence and your use of negotium@0.2.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.