registry / Staged payload carrier / negotium / 0.3.0

negotium@0.3.0

Install the Negotium multi-agent runtime and CLI with one package

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has an install-time native payload download and high-privilege runtime features, warranting a warning. Fixed checksum verification, package-owned storage, and no confirmed exfiltration or foreign control-surface mutation do not meet the blocking threshold.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall downloads the helpers; later Negotium browser/background-bash or agent runtime use activates them.

Impact

Supply-chain and high-privilege agent-runtime risk; no confirmed malicious exfiltration or install-time execution.

Mechanism

verified native-binary bootstrap plus user-invoked agent and shell execution

AI rationale

Evidence

package.jsoninstall-browser-rs.mjsinstall-bash-rs.mjsdist/background-bash.jsdist/browser-runtime.jsdist/main.js~/.negotium/binaries/browser-rs/v0.1.19/browser-rs~/.negotium/binaries/bash-rs/v0.1.5/bash-rs

Network endpoints2

github.com/maestrojeong/browser-rs-mcp/releases/download/v0.1.19github.com/maestrojeong/bash-rs-mcp/releases/download/v0.1.5

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json postinstall invokes both installer scripts.
install-browser-rs.mjs downloads a native executable to ~/.negotium/binaries and chmods it executable.
install-bash-rs.mjs likewise installs an executable native payload.
dist/background-bash.js later spawns the installed bash-rs binary.
dist/main.js runs agent sessions with broad permission settings.

Evidence against

Both installer downloads use fixed GitHub release URLs and pinned SHA-256 checksums.
Installers do not execute the downloaded binaries during postinstall.
Installers only write the package-owned ~/.negotium state directory.
No source-confirmed credential exfiltration or foreign agent-config mutation was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/hosted-agent.jsView file

9// ../../packages/core/src/agents/claude-provider.ts L10: import { spawn as spawn2 } from "child_process"; L11: import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";

High

Child Process

Package source references child process execution.

dist/hosted-agent.jsView on unpkg · L9

192var TSX_BIN = resolveDependencyBin("tsx"); L193: var TSX_LOADER = createRequire(import.meta.url).resolve("tsx"); L194: var TSCONFIG_PATH = resolve(PROJECT_ROOT, "tsconfig.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hosted-agent.jsView on unpkg · L192

dist/main.jsView file

1941async function bootstrapCodexModelCache(codexHome, cachePath) { L1942: const child = spawn(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], { L1943: env: { ...process.env, CODEX_HOME: codexHome }, L1944: stdio: ["pipe", "pipe", "pipe"] L1945: }); L1946: await new Promise((resolve4, reject) => { L1947: let settled = false;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/main.jsView on unpkg · L1941

1941async function bootstrapCodexModelCache(codexHome, cachePath) { L1942: const child = spawn(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], { L1943: env: { ...process.env, CODEX_HOME: codexHome }, ... L1945: }); L1946: await new Promise((resolve4, reject) => { L1947: let settled = false; L1948: let stdoutBuffer = ""; L1949: let stderr = ""; ... L1956: try { L1957: child.stdin.end(); L1958: child.kill();

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.jsView on unpkg · L1941

dist/agent-helpers.jsView file

3164Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/agent-helpers.js L3164: // ../../packages/core/src/agents/codex-app-server.ts L3165: import { spawn as spawn3 } from "child_process"; L3166: function createCodexAppServerForker(host) { ... L3168: const child = host.spawnServer(); L3169: return await new Promise((resolve6, reject) => { L3170: let settled = false; L3171: let stdoutBuffer = ""; L3172: let stderr = ""; ... L3179: try { L3180: child.stdin.end(); L3181: child.kill();

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/agent-helpers.jsView on unpkg · L3164

dist/runtime/scripts/faster-whisper-wrapper.pyView file

•path = dist/runtime/scripts/faster-whisper-wrapper.py kind = build_helper sizeBytes = 2704 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkg

dist/browser-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = negotium@0.1.32 matchedIdentity = npm:bmVnb3RpdW0:0.1.32 similarity = 0.350 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/browser-runtime.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/hosted-agent.jsView file

9// ../../packages/core/src/agents/claude-provider.ts L10: import { spawn as spawn2 } from "child_process"; L11: import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";

High

Child Process

Package source references child process execution.

dist/hosted-agent.jsView on unpkg · L9

Findings

1 Critical6 High6 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/browser-runtime.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/hosted-agent.js

HighShell

HighSame File Env Network Executiondist/main.js

HighCommand Output Exfiltrationdist/main.js

HighTrigger Reachable Command Output Exfiltrationdist/agent-helpers.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/hosted-agent.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py

Medium

Affected versions and remediation

This report applies to negotium@0.3.0.

See all versions of negotium for other recorded verdicts.

Review the evidence and your use of negotium@0.3.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-09 22:06:02.937Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.