registry / AI-agent capability abuse / negotium / 0.5.6

negotium@0.5.6

Install the Negotium multi-agent runtime and CLI with one package

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The scanner's claimed fixed credential gateway and foreign-package overwrite were not confirmed in source. The confirmed runtime manipulation of Codex session/control state is a dangerous, user-invoked agent capability and merits a warning rather than a malware block.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Run a Negotium workflow that invokes its Codex provider; npm installation triggers helper download.

Impact

A later resumed Codex session can inherit package-authored context and a permissive sandbox setting.

Mechanism

runtime Codex session/state fabrication and checksum-pinned native helper staging

AI rationale

Evidence

package.jsoninstall-browser-rs.mjsinstall-bash-rs.mjsdist/runtime/src/agents/codex-provider.tsdist/runtime/src/agents/codex-native-multi-agent.tsdist/runtime/src/agents/rollout/codex.ts~/.codex/sessions/<yyyy>/<mm>/<dd>/rollout-<ts>-<threadId>.jsonl~/.codex/negotium-model-catalog-<bundled-version>.json~/.negotium/binaries/browser-rs/v0.1.23/browser-rs~/.negotium/binaries/bash-rs/v0.1.7/bash-rs

Network endpoints2

github.com/maestrojeong/browser-rs/releases/download/v0.1.23github.com/maestrojeong/bash-rs-mcp/releases/download/v0.1.7

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Runtime creates synthetic Codex session rollouts and sets their sandbox policy to danger-full-access.
A user-invoked Codex turn writes a Negotium model catalog into the user's Codex state directory.
postinstall downloads native browser and shell helper binaries into ~/.negotium.

Evidence against

The Codex-state writes are reached during provider execution, not npm installation.
The downloaded helpers use fixed GitHub release locations and hard-coded SHA-256 verification.
Inspected MCP factory code exposes localhost endpoints; no fixed credential-redirection or command-output exfiltration endpoint was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/hosted-agent.jsView file

9// ../../packages/core/src/agents/claude-provider.ts L10: import { spawn as spawn2 } from "child_process"; L11: import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";

High

Child Process

Package source references child process execution.

dist/hosted-agent.jsView on unpkg · L9

192var TSX_BIN = resolveDependencyBin("tsx"); L193: var TSX_LOADER = createRequire(import.meta.url).resolve("tsx"); L194: var TSCONFIG_PATH = resolve(PROJECT_ROOT, "tsconfig.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hosted-agent.jsView on unpkg · L192

dist/mcp-factories.jsView file

1095async function bootstrapCodexModelCache(codexHome, cachePath) { L1096: const child = spawn(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], { L1097: env: { ...process.env, CODEX_HOME: codexHome }, L1098: stdio: ["pipe", "pipe", "pipe"] L1099: }); L1100: await new Promise((resolve4, reject) => { L1101: let settled = false;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-factories.jsView on unpkg · L1095

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/mcp-factories.js: writeFileSync writeFileSync(secretFile, `${envValue} writeFileSync(secretFile, `${secret} return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json"); writeFileSync as writeFileSync3 writeFileSync3(fd, payload); import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs"; const projectsDir = join3(homedir2(), ".claude", "projects", encodeClaudeCwd(opts.cwd));

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/mcp-factories.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/mcp-factories.js: writeFileSync const candidate = resolve(dir, "node_modules", ".bin", name); writeFileSync(secretFile, `${envValue} writeFileSync(secretFile, `${secret} writeFileSync as writeFileSync3 writeFileSync3(fd, payload); import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs"; copyFileSync,

dist/runtime/scripts/faster-whisper-wrapper.pyView file

•path = dist/runtime/scripts/faster-whisper-wrapper.py kind = build_helper sizeBytes = 2704 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkg

dist/browser-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = negotium@0.4.9 matchedIdentity = npm:bmVnb3RpdW0:0.4.9 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/browser-runtime.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/hosted-agent.jsView file

9// ../../packages/core/src/agents/claude-provider.ts L10: import { spawn as spawn2 } from "child_process"; L11: import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";

High

Child Process

Package source references child process execution.

dist/hosted-agent.jsView on unpkg · L9

Findings

1 Critical8 High6 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/browser-runtime.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/hosted-agent.js

HighShell

HighSame File Env Network Executiondist/mcp-factories.js

HighCredential Redirect Persistencedist/mcp-factories.js

HighEntrypoint Foreign Package Code Overwritedist/mcp-factories.js

HighCommand Output Exfiltrationdist/mcp-factories.js

HighTrigger Reachable Command Output Exfiltrationdist/mcp-factories.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/hosted-agent.js

Medium

Affected versions and remediation

This report applies to negotium@0.5.6.

See all versions of negotium for other recorded verdicts.

Review the evidence and your use of negotium@0.5.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-21 07:39:41.025Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.