negotium@0.6.9

Install the Negotium multi-agent runtime and CLI with one package

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The lifecycle download is package-aligned, hash-verified, and scoped to Negotium-owned storage. Scanner claims of credential redirection and foreign-package overwrite were not substantiated by the inspected source.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall; cron-summary runtime use

Impact

Installs package-aligned executables; optional cron summaries disclose their supplied prompt to the configured model endpoint.

Mechanism

verified helper-binary installation and configured API request

AI rationale

Evidence

package.jsoninstall-browser-rs.mjsinstall-bash-rs.mjsdist/runtime/cron/summarize.tsdist/mcp-factories.js~/.negotium/binaries/browser-rs/v0.1.23/browser-rs~/.negotium/binaries/bash-rs/v0.1.7/bash-rs

Network endpoints3

github.com/maestrojeong/browser-rs-mcp/releases/download/${VERSION}github.com/maestrojeong/bash-rs-mcp/releases/download/${VERSION}api.deepseek.com/v1/chat/completions

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Postinstall downloads and installs hash-verified browser-rs and bash-rs executables.
Cron summary runtime can send a configured API key and task text to the configured DeepSeek-compatible endpoint.

Evidence against

Downloads are SHA-256 verified and written only under Negotium's state directory.
No source evidence of foreign agent-config overwrite, credential redirection, hidden exfiltration, or remote code loading.
Codex configuration is read to identify existing MCP names; per-session SDK config is passed in memory.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 264 file(s), 5.87 MB of source, external domains: 127.0.0.1, api.deepseek.com, github.com, www.w3.org

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/hosted-agent.jsView file

9// ../../packages/core/src/agents/claude-provider.ts L10: import { spawn as spawn2 } from "child_process"; L11: import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";

High

Child Process

Package source references child process execution.

dist/hosted-agent.jsView on unpkg · L9

196var TSX_BIN = resolveDependencyBin("tsx"); L197: var TSX_LOADER = createRequire(import.meta.url).resolve("tsx"); L198: var TSCONFIG_PATH = resolve(PROJECT_ROOT, "tsconfig.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hosted-agent.jsView on unpkg · L196

dist/mcp-factories.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/mcp-factories.js: writeFileSync writeFileSync(secretFile, `${envValue} writeFileSync(secretFile, `${secret} return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json"); writeFileSync as writeFileSync3 writeFileSync3(fd, payload); import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs"; const projectsDir = join3(homedir2(), ".claude", "projects", encodeClaudeCwd(opts.cwd));

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/mcp-factories.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/mcp-factories.js: writeFileSync const candidate = resolve(dir, "node_modules", ".bin", name); writeFileSync(secretFile, `${envValue} writeFileSync(secretFile, `${secret} writeFileSync as writeFileSync3 writeFileSync3(fd, payload); import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs"; copyFileSync,

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/mcp-factories.jsView on unpkg

dist/main.jsView file

3910}); L3911: import { spawn as spawn3 } from "child_process"; L3912: function createCodexAppServerForker(host) { ... L3914: const child = host.spawnServer(); L3915: return await new Promise((resolve6, reject) => { L3916: let settled = false; L3917: let stdoutBuffer = ""; L3918: let stderr = ""; ... L3925: try { L3926: child.stdin.end(); L3927: child.kill();

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.jsView on unpkg · L3910

dist/agent-helpers.jsView file

3216Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/agent-helpers.js L3216: }); L3217: import { spawn as spawn3 } from "child_process"; L3218: function createCodexAppServerForker(host) { ... L3220: const child = host.spawnServer(); L3221: return await new Promise((resolve6, reject) => { L3222: let settled = false; L3223: let stdoutBuffer = ""; L3224: let stderr = ""; ... L3231: try { L3232: child.stdin.end(); L3233: child.kill();

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/agent-helpers.jsView on unpkg · L3216

dist/runtime/scripts/faster-whisper-wrapper.pyView file

•path = dist/runtime/scripts/faster-whisper-wrapper.py kind = build_helper sizeBytes = 2704 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime/scripts/faster-whisper-wrapper.pyView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install-browser-rs.mjs && node install-bash-rs.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/hosted-agent.jsView file

9// ../../packages/core/src/agents/claude-provider.ts L10: import { spawn as spawn2 } from "child_process"; L11: import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";

High

Child Process

Package source references child process execution.

dist/hosted-agent.jsView on unpkg · L9

Findings

7 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/hosted-agent.js

HighShell

HighCredential Redirect Persistencedist/mcp-factories.js

HighEntrypoint Foreign Package Code Overwritedist/mcp-factories.js

HighCommand Output Exfiltrationdist/main.js

HighTrigger Reachable Command Output Exfiltrationdist/agent-helpers.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/hosted-agent.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/runtime/scripts/faster-whisper-wrapper.py

Medium

Affected versions and remediation

This report applies to negotium@0.6.9.

See all versions of negotium for other recorded verdicts.

Review the evidence and your use of negotium@0.6.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-24 05:27:08.329Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.