registry / AI-agent capability abuse / negotium / 0.4.3

negotium@0.4.3

Install the Negotium multi-agent runtime and CLI with one package

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package contains a concrete runtime mechanism to create privileged-looking foreign Codex session state, warranting a warning. Its postinstall hook is limited to checksum-verified package-aligned binary downloads and does not modify AI-agent control surfaces.

Static reason

One or more suspicious static signals were detected.

Trigger

Invocation of the package's Codex rollout/runtime feature.

Impact

A user of the feature could create Codex session state advertising danger-full-access and no approvals.

Mechanism

writes privileged synthetic Codex session rollouts

AI rationale

Evidence

package.jsoninstall-browser-rs.mjsinstall-bash-rs.mjsdist/mcp-factories.jsCODEX_HOME/sessions/...~/.negotium/binaries/browser-rs/v0.1.22/browser-rs

Network endpoints1

github.com/maestrojeong/browser-rs-mcp/releases/download/v0.1.22

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Runtime rollout builder injects `danger-full-access` and disables approvals.
It writes synthetic Codex rollout files when its rollout operation is invoked.
Postinstall downloads checksum-pinned native helper binaries.

Evidence against

No install hook writes Codex, Claude, or other agent-control files.
No fixed credential-exfiltration gateway was found in inspected source.
The binary downloads are pinned to SHA-256 values and stored under Negotium state.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 254 file(s), 5.69 MB of source, external domains: 127.0.0.1, api.deepseek.com, github.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

Lines 113-153json

113 ],

114 "engines": {

115 "bun": ">=1.2.15"

116 },

117 "repository": {

118 "type": "git",

119 "url": "git+https://github.com/maestrojeong/negotium.git",

120 "directory": "apps/negotium"

121 },

122 "homepage": "https://github.com/maestrojeong/negotium#readme",

123 "bugs": {

124 "url": "https://github.com/maestrojeong/negotium/issues"

125 },

126 "publishConfig": {

127 "access": "public"

128 },

129 "scripts": {

130 "build": "bun ../../scripts/build-negotium-package.ts",

131 "check": "bunx tsc --noEmit",

132 "lint": "biome check",

133 "postinstall": "node install-browser-rs.mjs && node install-bash-rs.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L133

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L133

134 "prepack": "bun run build"

135 },

136 "dependencies": {

137 "@anthropic-ai/claude-agent-sdk": "^0.3.220",

138 "@anthropic-ai/sdk": "^0.111.0",

139 "@modelcontextprotocol/sdk": "^1.30.0",

140 "@openai/codex-sdk": "0.147.0",

141 "diff": "^9.0.0",

142 "maestro-agent-sdk": "0.2.4",

143 "node-telegram-bot-api": "^1.1.2",

144 "orchgraph": "0.2.1",

145 "pino": "^10.3.1",

146 "pino-pretty": "^13.1.3",

147 "tsx": "^4.22.4",

148 "zod": "^4.3.6"

149 },

150 "devDependencies": {

151 "@types/node": "^20",

152 "bun-types": "^1.3.11",

153 "typescript": "^5"

dist/chunk-ef4y7rz2.jsView file

Lines 3-43javascript

3var __defProp = Object.defineProperty;

4var __getOwnPropNames = Object.getOwnPropertyNames;

5var __hasOwnProp = Object.prototype.hasOwnProperty;

6var __toESM = (mod,

dist/mcp-factories.jsView file

1090async function bootstrapCodexModelCache(codexHome, cachePath) { L1091: const child = spawn(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], { L1092: env: { ...process.env, CODEX_HOME: codexHome }, L1093: stdio: ["pipe", "pipe", "pipe"] L1094: }); L1095: await new Promise((resolve4, reject) => { L1096: let settled = false;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-factories.jsView on unpkg · L1090

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/mcp-factories.js: writeFileSync writeFileSync(secretFile, `${envValue} writeFileSync(secretFile, `${secret} return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json"); writeFileSync as writeFileSync3 writeFileSync3(fd, payload); import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs"; const projectsDir = join3(homedir2(), ".claude", "projects", encodeClaudeCwd(opts.cwd));

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/mcp-factories.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/mcp-factories.js: writeFileSync const candidate = resolve(dir, "node_modules", ".bin", name); writeFileSync(secretFile, `${envValue} writeFileSync(secretFile, `${secret} writeFileSync as writeFileSync3 writeFileSync3(fd, payload); import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs"; copyFileSync,

dist/runtime/scripts/faster-whisper-wrapper.pyView file

•path = dist/runtime/scripts/faster-whisper-wrapper.py kind = build_helper sizeBytes = 2704 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-ef4y7rz2.jsView file

23// ../../[redacted].ts L24: import { execFileSync } from "child_process"; L25: import { randomBytes } from "crypto";

High

Child Process

Package source references child process execution.

dist/chunk-ef4y7rz2.jsView on unpkg · L23

Findings

8 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunk-ef4y7rz2.js

HighShell

HighSame File Env Network Executiondist/mcp-factories.js

HighCredential Redirect Persistencedist/mcp-factories.js

HighEntrypoint Foreign Package Code Overwritedist/mcp-factories.js

HighCommand Output Exfiltrationdist/mcp-factories.js

HighTrigger Reachable Command Output Exfiltrationdist/mcp-factories.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-ef4y7rz2.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper

Affected versions and remediation

This report applies to negotium@0.4.3.

See all versions of negotium for other recorded verdicts.

Review the evidence and your use of negotium@0.4.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-14 04:58:53.699Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.