negotium@0.6.6
Install the Negotium multi-agent runtime and CLI with one package
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe summary endpoint is configurable while the request forwards a DeepSeek key without destination validation. This supports a conditional credential exposure warning, not a finding of covert theft or malware intent.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Cron prompt summarization runs while a summary API key is available and NEGOTIUM_CRON_SUMMARY_URL points to an endpoint other than the intended service.
Impact
The configured recipient can receive and use the API key.
Mechanism
The code selects NEGOTIUM_CRON_SUMMARY_API_KEY or DEEPSEEK_API_KEY and sends it as a bearer token to the configured URL without restricting the destination.
AI rationale
The summary endpoint is configurable while the request forwards a DeepSeek key without destination validation. This supports a conditional credential exposure warning, not a finding of covert theft or malware intent.
Evidence
dist/main.js
Network endpoints1
api.deepseek.com/v1/chat/completions
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/main.js uses NEGOTIUM_CRON_SUMMARY_API_KEY or DEEPSEEK_API_KEY when summarizing a nonempty cron prompt.
- dist/main.js sends that key as a bearer token to NEGOTIUM_CRON_SUMMARY_URL when configured, without a destination restriction.
- The default summary endpoint is DeepSeek’s API; the exposure depends on configuring an alternate endpoint.
Evidence against
- package.json postinstall runs installers that download platform binaries from the package’s GitHub release URLs, verify their SHA-256 hashes, and store them under the Negotium state directory.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/hosted-agent.jsView file
9// ../../packages/core/src/agents/claude-provider.ts
L10: import { spawn as spawn2 } from "child_process";
L11: import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
High
Child Process
Package source references child process execution.
dist/hosted-agent.jsView on unpkg · L9Findings
1 Critical6 High6 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/browser-runtime.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/hosted-agent.js
HighCredential Redirect Persistencedist/mcp-factories.js
HighCommand Output Exfiltrationdist/main.js
HighTrigger Reachable Command Output Exfiltrationdist/agent-helpers.js
HighSemantic Analysis Limiteddist/runtime-helpers.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/hosted-agent.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py
Affected versions and remediation
This report applies to negotium@0.6.6.
See all versions of negotium for other recorded verdicts.
- Review the evidence and your use of negotium@0.6.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.