negotium@0.4.6
Install the Negotium multi-agent runtime and CLI with one package
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe install hook creates a meaningful lifecycle and native-binary supply-chain risk, so warn. Direct inspection contradicts the scanner's claimed credential redirect and foreign-package overwrite: no such behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall; runtime cron summarization when configured with an API key.
Impact
Adds executable runtime helpers under ~/.negotium; runtime requests can send scheduled-task text to the configured DeepSeek endpoint.
Mechanism
Package-owned verified binary bootstrap and optional API-backed task summarization.
AI rationale
The install hook creates a meaningful lifecycle and native-binary supply-chain risk, so warn. Direct inspection contradicts the scanner's claimed credential redirect and foreign-package overwrite: no such behavior was found.
Evidence
package.jsoninstall-browser-rs.mjsinstall-bash-rs.mjsdist/main.jsdist/mcp-factories.js~/.negotium/binaries/browser-rs/v0.1.22/browser-rs~/.negotium/binaries/bash-rs/v0.1.7/bash-rs
Network endpoints3
github.com/maestrojeong/browser-rs-mcp/releases/download/${VERSION}github.com/maestrojeong/bash-rs-mcp/releases/download/${VERSION}api.deepseek.com/v1/chat/completions
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- postinstall runs two downloader scripts.
- Installers download executable binaries into ~/.negotium and chmod them executable.
Evidence against
- Downloads use fixed GitHub release URLs and pinned SHA-256 checks.
- Writes are limited to the package-owned .negotium state directory; no foreign AI-agent config overwrite found.
- Credential-bearing DeepSeek request is runtime cron summarization, uses an explicit API-key environment variable, and targets api.deepseek.com.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/hosted-agent.jsView file
9// ../../packages/core/src/agents/claude-provider.ts
L10: import { spawn as spawn2 } from "child_process";
L11: import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
High
Child Process
Package source references child process execution.
dist/hosted-agent.jsView on unpkg · L9192var TSX_BIN = resolveDependencyBin("tsx");
L193: var TSX_LOADER = createRequire(import.meta.url).resolve("tsx");
L194: var TSCONFIG_PATH = resolve(PROJECT_ROOT, "tsconfig.json");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/hosted-agent.jsView on unpkg · L192dist/mcp-factories.jsView file
1090async function bootstrapCodexModelCache(codexHome, cachePath) {
L1091: const child = spawn(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], {
L1092: env: { ...process.env, CODEX_HOME: codexHome },
L1093: stdio: ["pipe", "pipe", "pipe"]
L1094: });
L1095: await new Promise((resolve4, reject) => {
L1096: let settled = false;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/mcp-factories.jsView on unpkg · L1090•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/mcp-factories.js:
writeFileSync
writeFileSync(secretFile, `${envValue}
writeFileSync(secretFile, `${secret}
return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json");
writeFileSync as writeFileSync3
writeFileSync3(fd, payload);
import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
const projectsDir = join3(homedir2(), ".claude", "projects", encodeClaudeCwd(opts.cwd));
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/mcp-factories.jsView on unpkg•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/mcp-factories.js:
writeFileSync
const candidate = resolve(dir, "node_modules", ".bin", name);
writeFileSync(secretFile, `${envValue}
writeFileSync(secretFile, `${secret}
writeFileSync as writeFileSync3
writeFileSync3(fd, payload);
import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
copyFileSync,
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/mcp-factories.jsView on unpkg1090async function bootstrapCodexModelCache(codexHome, cachePath) {
L1091: const child = spawn(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], {
L1092: env: { ...process.env, CODEX_HOME: codexHome },
...
L1094: });
L1095: await new Promise((resolve4, reject) => {
L1096: let settled = false;
L1097: let stdoutBuffer = "";
L1098: let stderr = "";
...
L1105: try {
L1106: child.stdin.end();
L1107: child.kill();
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/mcp-factories.jsView on unpkg · L10901090Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/mcp-factories.js
L1090: async function bootstrapCodexModelCache(codexHome, cachePath) {
L1091: const child = spawn(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], {
L1092: env: { ...process.env, CODEX_HOME: codexHome },
...
L1094: });
L1095: await new Promise((resolve4, reject) => {
L1096: let settled = false;
L1097: let stdoutBuffer = "";
L1098: let stderr = "";
...
L1105: try {
L1106: child.stdin.end();
L1107: child.kill();
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/mcp-factories.jsView on unpkg · L1090dist/runtime/scripts/faster-whisper-wrapper.pyView file
•path = dist/runtime/scripts/faster-whisper-wrapper.py
kind = build_helper
sizeBytes = 2704
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkgFindings
8 High6 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/hosted-agent.js
HighShell
HighSame File Env Network Executiondist/mcp-factories.js
HighCredential Redirect Persistencedist/mcp-factories.js
HighEntrypoint Foreign Package Code Overwritedist/mcp-factories.js
HighCommand Output Exfiltrationdist/mcp-factories.js
HighTrigger Reachable Command Output Exfiltrationdist/mcp-factories.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/hosted-agent.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to negotium@0.4.6.
See all versions of negotium for other recorded verdicts.
- Review the evidence and your use of negotium@0.4.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.