@dptech-corp/bohr-cli@2.6.22

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

npm installation or upgrade; a subsequent install can execute the prior downloaded tool for a version check.

A compromised or malicious release response can persist an unverified executable in the user's Bohr tool directory and later cause it to run.

remote binary staging in a lifecycle hook

The package has a concrete lifecycle-driven remote executable staging path with optional integrity validation, creating unresolved supply-chain risk. Source inspection found no credential exfiltration, destructive activity, or foreign AI-agent configuration mutation, so blocking as malicious is not justified.