@dptech-corp/bohr-cli@2.6.27: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@dptech-corp/bohr-cli@2.6.27: Suspicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

8"scripts": { "postinstall": "node postinstall.js" }

Medium

Suspicious Lifecycle Evidence

postinstall automatically fetches and installs an external executable.

package.jsonView on unpkg · L8

postinstall.jsView file

107try { L108: const { execFileSync } = require("child_process"); L109: const out = execFileSync(destPath, ["version"], { encoding: "utf8", timeout: 5000 });

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L107

121fs.mkdirSync(INSTALL_DIR, { recursive: true }); const tmpPath = destPath + ".tmp"; try { const actualHash = await downloadToFile(meta.url, tmpPath); if (meta.sha256 && actualHash !== meta.sha256) { fs.unlinkSync(tmpPath); console.error(`[postinstall] wenyon-cli: SHA256 mismatch (expected ${meta.sha256}, got ${actualHash}), skipping`); return; } fs.chmodSync(tmpPath, 0o755); fs.renameSync(tmpPath, destPath);

Medium

Suspicious Lifecycle Evidence

postinstall automatically fetches and installs an external executable.

postinstall.jsView on unpkg · L121

51const follow = (u) => { const req = mod.get(u, { headers: { "User-Agent": "bohr-cli-postinstall" }, timeout: timeoutMs }, (res) => { if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) { res.resume(); return follow(res.headers.location);

Medium

Ai Review Evidence

Release metadata controls the download URL; redirects are followed without host restriction.

postinstall.jsView on unpkg · L51

run.jsView file

64`package managers do this without reporting an error)`, L65: "npm install -g @dptech-corp/bohr-cli --force" L66: ); ... L69: try { L70: execFileSync(binaryPath, process.argv.slice(2), { stdio: "inherit" }); L71: } catch (e) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

run.jsView on unpkg · L64

Lines 87-141javascript

87

88 let meta;

89 try {

90 const buf = await get(metaUrl);

91 meta = JSON.parse(buf.toString());

92 } catch (e) {

93 console.error(`[postinstall] wenyon-cli: could not fetch release info (${e.message}), skipping`);

94 return;

95 }

96

97 if (!meta.url) {

98 console.error("[postinstall] wenyon-cli: no download URL in release response, skipping");

99 return;

100 }

101

102 // Check if already installed and up-to-date

103 const ext = platform.startsWith("windows") ? ".exe" : "";

104 const destPath = path.join(INSTALL_DIR, `wenyon-cli${ext}`);

105

106 if (fs.existsSync(destPath) && meta.version) {

107 try {

108 const { execFileSync } = require("child_process");

109 const out = execFileSync(destPath, ["version"], { encoding: "utf8", timeout: 5000 });

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L107

110 if (out.includes(meta.version)) {

111 console.log(`[postinstall] wenyon-cli ${meta.version} already installed`);

112 return;

113 }

114 } catch (_) {

115 // version check failed, proceed with install

116 }

117 }

118

119 console.log(`[postinstall] Installing wenyon-cli ${meta.version || ""} (${platform})...`);

120

121 fs.mkdirSync(INSTALL_DIR, { recursive: true });

122

123 const tmpPath = destPath + ".tmp";

124 try {

125 const actualHash = await downloadToFile(meta.url, tmpPath);

126

127 if (meta.sha256 && actualHash !== meta.sha256) {

128 fs.unlinkSync(tmpPath);

129 console.error(`[postinstall] wenyon-cli: SHA256 mismatch (expected ${meta.sha256}, got ${actualHash}), skipping`);

130 return;

131 }

132

Medium

Suspicious Lifecycle Evidence

postinstall automatically fetches and installs an external executable.

postinstall.jsView on unpkg · L121

133 fs.chmodSync(tmpPath, 0o755);

134 fs.renameSync(tmpPath, destPath);

135 console.log(`[postinstall] wenyon-cli ${meta.version || ""} installed to ${destPath}`);

136 } catch (e) {

137 try { fs.unlinkSync(tmpPath); } catch (_) {}

138 console.error(`[postinstall] wenyon-cli: download failed (${e.message}), skipping`);

139 }

140}

141