registry / negotium / 0.22.5

negotium@0.22.5

⚠ Under review

Install the Negotium multi-agent runtime and CLI with one package

AI Security Review

scanned 19h ago · by lpm-firewall-ai

The inspected lifecycle installers and flagged agent integration locations show no confirmed attack behavior. Manual review is warranted because the declared @anthropic-ai/sdk dependency’s source was unavailable, so its install behavior could not be verified.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package also installs its declared dependencies.

Impact

The dependency’s installation behavior cannot be assessed from this snapshot.

Mechanism

The package declares @anthropic-ai/sdk, but its dependency source was unavailable in the supplied snapshot, leaving its install behavior unverified.

AI rationale

Evidence

package.jsondist/runtime/src/agents/claude-provider.ts

Decision evidence

public snapshot

AI called this Manual Review at 79.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json declares @anthropic-ai/sdk, and the Claude provider imports its message types; the dependency source was unavailable in the supplied snapshot.
The inspected agent integration code resolves local Codex authentication paths, handles Claude session files during session operations, and creates a private Codex hook bridge for a provider turn.
The postinstall hook installs versioned browser and shell binaries into Negotium’s state directory and checks each download against a pinned hash.

Evidence against

The inspected integration locations show no confirmed attack behavior; their observed file operations support agent sessions and a private per-turn hook.
The postinstall installers target Negotium’s own binary directory and verify downloaded binaries against pinned hashes.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

20 flagged

package.jsonView file

Lines 124-164json

124 ],

125 "engines": {

126 "bun": ">=1.2.15"

127 },

128 "repository": {

129 "type": "git",

130 "url": "git+https://github.com/maestrojeong/negotium.git",

131 "directory": "apps/negotium"

132 },

133 "homepage": "https://github.com/maestrojeong/negotium#readme",

134 "bugs": {

135 "url": "https://github.com/maestrojeong/negotium/issues"

136 },

137 "publishConfig": {

138 "access": "public"

139 },

140 "scripts": {

141 "build": "bun ../../scripts/build-negotium-package.ts",

142 "check": "bunx tsc --noEmit",

143 "lint": "biome check",

144 "postinstall": "node install-browser-rs.mjs && node install-bash-rs.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L144

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L144

145 "prepack": "bun run build"

146 },

147 "dependencies": {

148 "@anthropic-ai/claude-agent-sdk": "^0.3.281",

149 "@anthropic-ai/sdk": "^0.124.0",

150 "@modelcontextprotocol/sdk": "^1.30.0",

151 "@openai/codex-sdk": "^0.156.1",

152 "diff": "^9.0.0",

153 "maestro-agent-sdk": "0.5.4",

154 "node-telegram-bot-api": "^1.1.2",

155 "orchgraph": "0.2.4",

156 "pino": "^10.3.1",

157 "pino-pretty": "^13.1.3",

158 "tsx": "^4.23.13",

159 "zod": "4.4.3"

160 },

161 "devDependencies": {

162 "@types/node": "^26.4.1",

163 "bun-types": "^1.4.2",

164 "typescript": "^5"

dist/hosted-agent.jsView file

Lines 30-70javascript

30 SYSTEM_HEALTH_SERVER,

31 TASK_SERVER,

32 TOKEN_STATS_SERVER,

33 TOPIC_WORKSPACE_DIR,

34 TSCONFIG_PATH,

35 TSX_LOADER,

36 VAULT_MASTER_KEY

dist/mcp-factories.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/mcp-factories.js: writeFileSync writeFileSync(secretFile, `${envValue} writeFileSync(secretFile, `${secret} delete env.CLAUDECODE; return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json"); writeFileSync as writeFileSync3 writeFileSync3(fd, payload); import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/mcp-factories.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = negotium@0.22.4 matchedPath = dist/mcp-factories.js matchedIdentity = npm:bmVnb3RpdW0:0.22.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp-factories.jsView on unpkg

dist/main.jsView file

22var init_maestro_bootstrap_env = __esm(() => { L23: process.env.MAESTRO_SDK_SILENT_BOOTSTRAP ??= "1"; L24: }); ... L188: }); L189: import { execFileSync } from "child_process"; L190: import { randomBytes } from "crypto"; ... L219: function dependencyBinNames(name) { L220: if (process.platform !== "win32") L221: return [name]; ... L359: } L360: const secret = randomBytes(32).toString("base64url"); L361: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.jsView on unpkg · L22

•matchType = normalized_sha256 matchedPackage = negotium@0.22.4 matchedPath = dist/main.js matchedIdentity = npm:bmVnb3RpdW0:0.22.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/main.jsView on unpkg

dist/runtime/scripts/faster-whisper-wrapper.pyView file

•path = dist/runtime/scripts/faster-whisper-wrapper.py kind = build_helper sizeBytes = 2704 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkg

dist/query-runtime.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/query-runtime.js#virtual:normalized:round1View on unpkg

dist/background-bash.jsView file

•matchType = normalized_sha256 matchedPackage = negotium@0.22.4 matchedPath = dist/background-bash.js matchedIdentity = npm:bmVnb3RpdW0:0.22.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/background-bash.jsView on unpkg

dist/browser-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = negotium@0.22.4 matchedPath = dist/browser-runtime.js matchedIdentity = npm:bmVnb3RpdW0:0.22.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browser-runtime.jsView on unpkg

dist/agent-helpers.jsView file

•matchType = normalized_sha256 matchedPackage = negotium@0.22.4 matchedPath = dist/agent-helpers.js matchedIdentity = npm:bmVnb3RpdW0:0.22.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agent-helpers.jsView on unpkg

dist/chunk-vh8px000.jsView file

•matchType = normalized_sha256 matchedPackage = negotium@0.22.4 matchedPath = dist/chunk-rwj7x5pg.js matchedIdentity = npm:bmVnb3RpdW0:0.22.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-vh8px000.jsView on unpkg

dist/media.jsView file

•matchType = normalized_sha256 matchedPackage = negotium@0.22.4 matchedPath = dist/media.js matchedIdentity = npm:bmVnb3RpdW0:0.22.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/media.jsView on unpkg

dist/query-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = negotium@0.22.4 matchedPath = dist/query-runtime.js matchedIdentity = npm:bmVnb3RpdW0:0.22.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/query-runtime.jsView on unpkg

dist/runtime-helpers.jsView file

•matchType = normalized_sha256 matchedPackage = negotium@0.22.4 matchedPath = dist/runtime-helpers.js matchedIdentity = npm:bmVnb3RpdW0:0.22.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime-helpers.jsView on unpkg

dist/runtime/src/agents/codex-native-multi-agent.tsView file

•matchType = normalized_sha256 matchedPackage = negotium@0.22.4 matchedPath = dist/runtime/src/agents/codex-native-multi-agent.ts matchedIdentity = npm:bmVnb3RpdW0:0.22.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/src/agents/codex-native-multi-agent.tsView on unpkg

dist/runtime/src/platform/playwright/manager.tsView file

•matchType = normalized_sha256 matchedPackage = negotium@0.22.4 matchedPath = [redacted].ts matchedIdentity = npm:bmVnb3RpdW0:0.22.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/src/platform/playwright/manager.tsView on unpkg

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/hosted-agent.jsView file

50// ../../packages/core/src/agents/claude-provider.ts L51: import { spawn as spawn2 } from "child_process"; L52: import { existsSync, readFileSync as readFileSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/hosted-agent.jsView on unpkg · L50

Findings

17 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/hosted-agent.js

HighCredential Redirect Persistencedist/mcp-factories.js

HighCommand Output Exfiltrationdist/main.js

HighSemantic Analysis Limiteddist/query-runtime.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/background-bash.js

HighKnown Malware Source Similaritydist/browser-runtime.js

HighKnown Malware Source Similaritydist/hosted-agent.js

HighKnown Malware Source Similaritydist/main.js

HighKnown Malware Source Similaritydist/mcp-factories.js

HighKnown Malware Source Similaritydist/agent-helpers.js

Affected versions and remediation

This report applies to negotium@0.22.5.

See all versions of negotium for other recorded verdicts.

Review the evidence and your use of negotium@0.22.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 07:06:52.077Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.