registry / negotium / 0.22.6

negotium@0.22.6

⚠ Under review

Install the Negotium multi-agent runtime and CLI with one package

AI Security Review

scanned 15h ago · by lpm-firewall-ai

Inspected source shows checksum-verified binary setup and agent session helpers, with no confirmed attack behavior. The unresolved imported Anthropic SDK source leaves a selected runtime dependency unassessed, so manual review is appropriate.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Runtime use of the Anthropic-backed agent provider.

Impact

The provider’s dependency behavior remains unassessed; no malicious behavior is confirmed.

Mechanism

The package imports the Anthropic SDK, whose selected dependency source could not be resolved for this review.

AI rationale

Evidence

dist/runtime/src/agents/claude-provider.tspackage.json

Decision evidence

public snapshot

AI called this Manual Review at 74.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json declares an automatic postinstall that runs two binary setup scripts.
The setup scripts fetch fixed GitHub release assets and verify their SHA-256 before storing them in the package state directory.
The package imports the Anthropic SDK, but the selected dependency source was not resolved in this review.
The inspected agent paths read configured Codex authentication locations and support Claude session rollout files; these excerpts do not establish credential transfer or unrequested agent changes.

Evidence against

Claude rollout creation is called from the agent registry’s rollout operation, consistent with session management.
The postinstall binary setup is limited to package-specific state paths and checksum-verified downloads.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

20 flagged

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/hosted-agent.jsView file

47// ../../packages/core/src/agents/claude-provider.ts L48: import { spawn as spawn2 } from "child_process"; L49: import { existsSync, readFileSync as readFileSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/hosted-agent.jsView on unpkg · L47

946if (isBun) { L947: ({ Database } = await import("bun:sqlite")); L948: } else {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hosted-agent.jsView on unpkg · L946

dist/mcp-factories.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/mcp-factories.js: writeFileSync writeFileSync(secretFile, `${envValue} writeFileSync(secretFile, `${secret} return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json"); writeFileSync as writeFileSync3 writeFileSync3(fd, payload); import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs"; const projectsDir = join3(homedir2(), ".claude", "projects", encodeClaudeCwd(opts.cwd));

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/mcp-factories.jsView on unpkg

dist/main.jsView file

31var init_maestro_bootstrap_env = __esm(() => { L32: process.env.MAESTRO_SDK_SILENT_BOOTSTRAP ??= "1"; L33: }); ... L98: // ../../[redacted].ts L99: import { execFileSync } from "child_process"; L100: import { randomBytes } from "crypto"; ... L129: function dependencyBinNames(name) { L130: if (process.platform !== "win32") L131: return [name]; ... L266: } L267: const secret = randomBytes(32).toString("base64url"); L268: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.jsView on unpkg · L31

dist/runtime/scripts/faster-whisper-wrapper.pyView file

•path = dist/runtime/scripts/faster-whisper-wrapper.py kind = build_helper sizeBytes = 2704 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkg

dist/query-runtime.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/query-runtime.js#virtual:normalized:round1View on unpkg

dist/background-bash.jsView file

•matchType = normalized_sha256 matchedPackage = negotium@0.22.4 matchedPath = dist/background-bash.js matchedIdentity = npm:bmVnb3RpdW0:0.22.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High