registry / negotium / 0.22.3

negotium@0.22.3

Install the Negotium multi-agent runtime and CLI with one package

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Source inspection found a postinstall binary setup with pinned project releases and SHA-256 checks, plus runtime behavior consistent with local agent and provider use. The reported credential redirect is not supported by the inspected provider configuration, which reads user vault keys for named providers.

Static reason

One or more suspicious static signals were detected.

Trigger

Package installation triggers the two binary installers; provider and agent code runs when those runtime features are used.

Impact

No unauthorized credential transfer, destructive behavior, or other confirmed attack impact was established.

Mechanism

The installers fetch pinned releases from the project GitHub repositories and verify their digests. Provider keys come from the user's vault, while inspected agent helpers use local user configuration and session files.

AI rationale

Network endpoints2

github.com/maestrojeong/browser-rs-mcp/releases/download/${VERSION}github.com/maestrojeong/bash-rs-mcp/releases/download/${VERSION}

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The postinstall hook runs two installers that fetch version-pinned project releases and check each binary against a SHA-256 value before writing it.
Maestro provider keys are read from the user's vault for named providers and passed to the provider configuration; the inspected flow shows no fixed unofficial gateway.
The inspected Codex server launch uses the local runtime and communicates over standard input and output.
The inspected agent paths use the user's Codex home or the default home directory for authentication and scoped runtime configuration.
Claude rollout helpers write or move session records within the user's Claude projects directory.
The query runtime excerpt initializes a local SQLite adapter.

Evidence against

Installation triggers a postinstall hook, and the runtime handles provider credentials and launches local agent processes; the inspected source shows these behaviors in product-related flows.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVars

Source & flagged code

8 flagged

package.jsonView file

Lines 124-164json

124 ],

125 "engines": {

126 "bun": ">=1.2.15"

127 },

128 "repository": {

129 "type": "git",

130 "url": "git+https://github.com/maestrojeong/negotium.git",

131 "directory": "apps/negotium"

132 },

133 "homepage": "https://github.com/maestrojeong/negotium#readme",

134 "bugs": {

135 "url": "https://github.com/maestrojeong/negotium/issues"

136 },

137 "publishConfig": {

138 "access": "public"

139 },

140 "scripts": {

141 "build": "bun ../../scripts/build-negotium-package.ts",

142 "check": "bunx tsc --noEmit",

143 "lint": "biome check",

144 "postinstall": "node install-browser-rs.mjs && node install-bash-rs.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L144

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L144

145 "prepack": "bun run build"

146 },

147 "dependencies": {

148 "@anthropic-ai/claude-agent-sdk": "^0.3.281",

149 "@anthropic-ai/sdk": "^0.124.0",

150 "@modelcontextprotocol/sdk": "^1.30.0",

151 "@openai/codex-sdk": "^0.156.1",

152 "diff": "^9.0.0",

153 "maestro-agent-sdk": "0.5.4",

154 "node-telegram-bot-api": "^1.1.2",

155 "orchgraph": "0.2.4",

156 "pino": "^10.3.1",

157 "pino-pretty": "^13.1.3",

158 "tsx": "^4.23.13",

159 "zod": "4.4.3"

160 },

161 "devDependencies": {

162 "@types/node": "^26.4.1",

163 "bun-types": "^1.4.2",

164 "typescript": "^5"

dist/chunk-6c637pwe.jsView file

Lines 1-27javascript

1// @bun

2import {

3 hostedCodexHomePath,

4 latestCodexRolloutPath

5} from "./chunk-kn8y5scr.js";

7// ../../packages/core/src/agents/codex-app-server.ts

8import { spawn } from "child_process";

dist/hosted-agent.jsView file

Lines 929-969javascript

929}

930

931// ../../packages/core/src/platform/constants.ts

932var FROM_AUTO_CONTINUE = "auto-continue";

933var FROM_SELF_SCHEDULE = "self-schedule";

934var RESERVED_TOPIC_NAMES

dist/mcp-factories.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/mcp-factories.js: writeFileSync writeFileSync(secretFile, `${envValue} writeFileSync(secretFile, `${secret} delete env.CLAUDECODE; return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json"); writeFileSync as writeFileSync3 writeFileSync3(fd, payload); import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/mcp-factories.jsView on unpkg

dist/main.jsView file

22var init_maestro_bootstrap_env = __esm(() => { L23: process.env.MAESTRO_SDK_SILENT_BOOTSTRAP ??= "1"; L24: }); ... L188: }); L189: import { execFileSync } from "child_process"; L190: import { randomBytes } from "crypto"; ... L219: function dependencyBinNames(name) { L220: if (process.platform !== "win32") L221: return [name]; ... L359: } L360: const secret = randomBytes(32).toString("base64url"); L361: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.jsView on unpkg · L22

dist/runtime/scripts/faster-whisper-wrapper.pyView file

•path = dist/runtime/scripts/faster-whisper-wrapper.py kind = build_helper sizeBytes = 2704 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkg

dist/query-runtime.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/query-runtime.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-6c637pwe.jsView file

7// ../../packages/core/src/agents/codex-app-server.ts L8: import { spawn } from "child_process"; L9:

High

Child Process

Package source references child process execution.

dist/chunk-6c637pwe.jsView on unpkg · L7

Findings

5 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunk-6c637pwe.js

HighCredential Redirect Persistencedist/mcp-factories.js

HighCommand Output Exfiltrationdist/main.js

HighSemantic Analysis Limiteddist/query-runtime.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/hosted-agent.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to negotium@0.22.3.

See all versions of negotium for other recorded verdicts.

Review the evidence and your use of negotium@0.22.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 09:40:09.225Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.