registry / @dptech-corp/bohr-cli / 2.6.40

@dptech-corp/bohr-cli@2.6.40

CLI tool for Bohrium scientific computing platform

AI Security Review

scanned 11d ago · by lpm-firewall-ai

npm postinstall fetches remotely selected native executables and installs them into the user's ~/.bohr tool directories. The hashes are obtained from the same remote release/manifest flow.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install of the package

Impact

A compromised or malicious release endpoint can stage a native executable for later use.

Mechanism

install-time remote binary download and executable-file installation

Rationale

The package has a concrete install-time remote-binary staging capability but no source evidence of malicious intent, credential theft, destructive behavior, or AI-agent control hijacking. This warrants warning rather than publication blocking.

Evidence

package.jsonpostinstall.jsrun.js~/.bohr/tools/trisol/current/trisol~/.bohr/tools/wenyon/current/wenyon-cli

Network endpoints2

trisol.dp.tech/api/v1/cli/manifestwenyon.dp.tech/cli/releases/latest/download

Decision evidence

public snapshot

with false-positive risk.

@dptech-corp/bohr-cli@2.6.40

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code