negotium@0.21.0
Install the Negotium multi-agent runtime and CLI with one package
AI Security Review
scanned 14d ago · by lpm-firewall-aiInspected sources show a postinstall hook for package-owned runtime binaries and no confirmed malicious data flow. The scanner's gateway and command-output signals were not substantiated by the inspected source.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm installation triggers postinstall; the binary installers run unless their respective skip variables are set.
Impact
This provides the package's browser and shell runtime binaries; no credential exfiltration or agent control hijack was established.
Mechanism
The installers select fixed platform release assets, place them beneath the package state directory, and verify downloaded content with SHA-256 checks.
AI rationale
Inspected sources show a postinstall hook for package-owned runtime binaries and no confirmed malicious data flow. The scanner's gateway and command-output signals were not substantiated by the inspected source.
Evidence
package.jsoninstall-browser-rs.mjsinstall-bash-rs.mjs
Network endpoints1
github.com
Decision evidence
public snapshotAI called this Clean at 75.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json sets a postinstall hook to run the two package-owned binary installers.
- The browser installer downloads a fixed release asset to the package's state directory and checks its SHA-256 digest before accepting it.
- The bash installer likewise uses fixed release assets, digest checks, and a package state directory.
- The inspected agent configuration locations show auth path selection, session-file writing, and per-run Codex environment setup; they do not establish an unconsented install-time control-surface mutation.
- DEEPSEEK_API_KEY is read from the vault for model configuration; the inspected search found no api.deepseek endpoint literal.
Evidence against
- No inspected source established credential forwarding to an unofficial gateway or command-output exfiltration.
- The postinstall hook invokes package-aligned binary setup rather than modifying a foreign AI-agent configuration surface.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/hosted-agent.jsView file
50// ../../packages/core/src/agents/claude-provider.ts
L51: import { spawn as spawn2 } from "child_process";
L52: import { existsSync, readFileSync as readFileSync2 } from "fs";
High
Child Process
Package source references child process execution.
dist/hosted-agent.jsView on unpkg · L50Findings
1 Critical5 High6 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/browser-runtime.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/hosted-agent.js
HighCredential Redirect Persistencedist/mcp-factories.js
HighCommand Output Exfiltrationdist/main.js
HighSemantic Analysis Limiteddist/query-runtime.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/hosted-agent.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to negotium@0.21.0.
See all versions of negotium for other recorded verdicts.
- Review the evidence and your use of negotium@0.21.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.