Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@dptech-corp/bohr-cli@2.6.24: Suspicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 12 finding(s) warrant review before installing.

View on npm All versions

registry / @dptech-corp/bohr-cli / 2.6.24

@dptech-corp/bohr-cli@2.6.24

CLI tool for Bohrium scientific computing platform

AI Security Review

scanned 16d ago · by lpm-firewall-ai

npm installation automatically retrieves and stores an external platform executable. The artifact URL comes from remote metadata and is only conditionally hash-verified.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install of this package

Impact

A compromised or unsigned metadata response can cause an untrusted executable to persist under the user's home directory.

Mechanism

postinstall remote binary staging

Rationale

This is a documented vendor tool installer, but it creates a real install-time remote payload channel without mandatory integrity pinning. It merits a warning rather than a block because no concrete malicious chain is shown.

Evidence

package.jsonpostinstall.jsCHANGELOG.md~/.bohr/tools/wenyon/current/wenyon-cli

Network endpoints2

wenyon.dp.techwenyon.dp.tech/cli/releases/latest/download?platform=${platform}&variant=external

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Evidence for warning

postinstall runs automatically on npm install.
It fetches release metadata and downloads a remotely supplied executable.
The SHA-256 check is optional when metadata omits sha256; redirects are followed.
It chmods and persists the downloaded binary under ~/.bohr.

Evidence against

The behavior is disclosed in bundled comments and changelog as wenyon-cli installation.
No credential harvesting, exfiltration, AI-agent config mutation, or destructive action is present.
The newly downloaded binary is not executed by this postinstall path.

Behavioral surface

Source

ChildProcessCryptoFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 7.75 KB of source, external domains: wenyon.dp.tech

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

8"scripts": { "postinstall": "node postinstall.js" }

Medium

Suspicious Lifecycle Evidence

postinstall runs automatically on npm install.

package.jsonView on unpkg · L8

postinstall.jsView file

107try { L108: const { execFileSync } = require("child_process"); L109: const out = execFileSync(destPath, ["version"], { encoding: "utf8", timeout: 5000 });

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L107

86const metaUrl = `${WENYON_SERVER}/cli/releases/latest/download?platform=${platform}&variant=external`; let meta; try { const buf = await get(metaUrl); meta = JSON.parse(buf.toString());

Medium

Ai Review Evidence

It fetches release metadata and downloads a remotely supplied executable.

postinstall.jsView on unpkg · L86

125const actualHash = await downloadToFile(meta.url, tmpPath); if (meta.sha256 && actualHash !== meta.sha256) { fs.unlinkSync(tmpPath); console.error(`[postinstall] wenyon-cli: SHA256 mismatch (expected ${meta.sha256}, got ${actualHash}), skipping`); return;

Medium

Ai Review Evidence

The SHA-256 check is optional when metadata omits sha256; redirects are followed.

postinstall.jsView on unpkg · L125

run.jsView file

64`package managers do this without reporting an error)`, L65: "npm install -g @dptech-corp/bohr-cli --force" L66: ); ... L69: try { L70: execFileSync(binaryPath, process.argv.slice(2), { stdio: "inherit" }); L71: } catch (e) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

run.jsView on unpkg · L64

Findings

3 High6 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpostinstall.js

HighRuntime Package Installrun.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencepostinstall.js

MediumAi Review Evidencepostinstall.js

LowScripts Present

LowFilesystem

LowUrl Strings

90%Warn

Verdict confidence

IntentDangerous Capability

TypeStaged Payload Carrier

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

AuthorDP Technology

Maintainersdingzhaohan

Version2.6.74

PublishedAug 17, 2026

LicenseMIT

Dependencies6

Integrityverified

Package size33.2 KB

Files5

Keywordsbohriumscientific-computingclipaper-searchmolecular-dynamics

Runtime surface

package.json

Entrypointsbin → bohr

Runtimeos darwin, linux, win32cpu x64, arm64

Artifact75.9 KB · 5 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessCryptoFilesystemNetworkUrlStringsManifest: clean

LPM CLI

Source & flagged code

7 flagged

package.jsonView file

Lines 1-29json

1{

2 "name": "@dptech-corp/bohr-cli",

3 "version": "2.6.24",

4 "description": "CLI tool for Bohrium scientific computing platform",

5 "bin": {

6 "bohr": "run.js"

7 },

8 "scripts": {

9 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

Medium

Suspicious Lifecycle Evidence

postinstall runs automatically on npm install.

package.jsonView on unpkg · L8

11 "keywords": [

12 "bohrium",

13 "scientific-computing",

14 "cli",

15 "paper-search",

16 "molecular-dynamics"

17 ],

18 "author": "DP Technology",

19 "license": "MIT",

20 "os": [

21 "darwin",

22 "linux",

23 "win32"

24 ],

25 "cpu": [

26 "x64",

27 "arm64"

28 ],

29 "files": [

postinstall.jsView file

Lines 66-145javascript

66 });

67 res.on("end", () => {

68 file.end(() => resolve(hash.digest("hex")));

69 });

70 res.on(

run.jsView file

Lines 44-84javascript

44 );

45}

46

47const ext = platform === "win32" ? ".exe" : "";

48const pkgName

"error"

, (

e

)

=>

{ file.

close

();

reject

(e); });

71 });

72 req.on("error", reject);

73 req.on("timeout", () => { req.destroy(); reject(new Error("download timed out")); });

74 };

75 follow(url);

76 });

77}

78

79async function main() {

80 const platform = getPlatform();

81 if (!platform) {

82 // Unsupported platform for wenyon — skip silently

83 return;

84 }

85

86 const metaUrl = `${WENYON_SERVER}/cli/releases/latest/download?platform=${platform}&variant=external`;

87

88 let meta;

89 try {

90 const buf = await get(metaUrl);

91 meta = JSON.parse(buf.toString());

Medium

Ai Review Evidence

It fetches release metadata and downloads a remotely supplied executable.

postinstall.jsView on unpkg · L86

92 } catch (e) {

93 console.error(`[postinstall] wenyon-cli: could not fetch release info (${e.message}), skipping`);

94 return;

95 }

96

97 if (!meta.url) {

98 console.error("[postinstall] wenyon-cli: no download URL in release response, skipping");

99 return;

100 }

101

102 // Check if already installed and up-to-date

103 const ext = platform.startsWith("windows") ? ".exe" : "";

104 const destPath = path.join(INSTALL_DIR, `wenyon-cli${ext}`);

105

106 if (fs.existsSync(destPath) && meta.version) {

107 try {

108 const { execFileSync } = require("child_process");

109 const out = execFileSync(destPath, ["version"], { encoding: "utf8", timeout: 5000 });

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L107

110 if (out.includes(meta.version)) {

111 console.log(`[postinstall] wenyon-cli ${meta.version} already installed`);

112 return;

113 }

114 } catch (_) {

115 // version check failed, proceed with install

116 }

117 }

118

119 console.log(`[postinstall] Installing wenyon-cli ${meta.version || ""} (${platform})...`);

120

121 fs.mkdirSync(INSTALL_DIR, { recursive: true });

122

123 const tmpPath = destPath + ".tmp";

124 try {

125 const actualHash = await downloadToFile(meta.url, tmpPath);

126

127 if (meta.sha256 && actualHash !== meta.sha256) {

128 fs.unlinkSync(tmpPath);

129 console.error(`[postinstall] wenyon-cli: SHA256 mismatch (expected ${meta.sha256}, got ${actualHash}), skipping`);

130 return;

Medium

Ai Review Evidence

The SHA-256 check is optional when metadata omits sha256; redirects are followed.

postinstall.jsView on unpkg · L125

131 }

132

133 fs.chmodSync(tmpPath, 0o755);

134 fs.renameSync(tmpPath, destPath);

135 console.log(`[postinstall] wenyon-cli ${meta.version || ""} installed to ${destPath}`);

136 } catch (e) {

137 try { fs.unlinkSync(tmpPath); } catch (_) {}

138 console.error(`[postinstall] wenyon-cli: download failed (${e.message}), skipping`);

139 }

140}

141

142main().catch((e) => {

143 // postinstall failures must not break npm install

144 console.error(`[postinstall] wenyon-cli: ${e.message}`);

145});

=

`@dptech-corp/bohr-cli-${

mappedPlatform

}-${

mappedArch

}`

;

49const binaryName = `bohr${ext}`;

50

51let binaryPath;

52try {

53 const pkgDir = path.dirname(require.resolve(`${pkgName}/package.json`));

54 binaryPath = path.join(pkgDir, "bin", binaryName);

55} catch (e) {

56 // Keep naming the cause: npm reports success (exit 0) when it skips an

57 // optional dependency, so "install worked but bohr will not run" is a state

58 // the user has no other way to explain. --omit=optional, an old npm, and

59 // pnpm's global installs all land here.

60 failPrecondition(

61 "platform_package_missing",

62 `the platform package ${pkgName} is not installed; npm most likely skipped ` +

63 `the optional dependency for this platform (--omit=optional and some ` +

64 `package managers do this without reporting an error)`,

65 "npm install -g @dptech-corp/bohr-cli --force"

66 );

67}

68

69try {

70 execFileSync(binaryPath, process.argv.slice(2), { stdio: "inherit" });

71} catch (e) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

run.jsView on unpkg · L64

72 // e.status is null when the child was killed by a signal; exiting 1 there

73 // would report an ordinary failure for a SIGINT. Exit codes are how the

74 // billing gate (10) and every other envelope code reach the caller, so this

75 // must pass through untouched when there is one.

76 if (typeof e.status === "number") {

77 process.exit(e.status);

78 }

79 if (e.signal) {

80 process.exit(128 + (os.constants.signals[e.signal] || 0));

81 }

82 process.exit(1);

83}

84