registry / @dptech-corp/bohr-cli / 2.6.56

@dptech-corp/bohr-cli@2.6.56

CLI tool for Bohrium scientific computing platform

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Inspected source is a vendor CLI launcher plus a documented postinstall that pulls hashed companion binaries from dp.tech into ~/.bohr/tools. Malware-similarity and runtime-install labels are noisy: they match that installer shape and a help string, not a hidden attack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package runs postinstall.js; running the bohr command runs run.js.

Impact

No confirmed malicious impact in this package source; extra tools land under ~/.bohr/tools and the CLI runs only when the user invokes bohr.

Mechanism

First-party companion download and platform binary launch

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

package.json describes a Bohrium CLI, points the bohr command at run.js, runs postinstall.js after install, and pins same-version platform optional packages instead of depending on this package name again.
run.js only resolves the matching @dptech-corp/bohr-cli platform package and runs that binary with the user's arguments; the npm install text is a printed hint, not a command the launcher executes.
postinstall.js downloads trisol and wenyon-cli from wenyon.dp.tech and trisol.dp.tech into ~/.bohr/tools and rejects files whose SHA-256 hash does not match.
Install writes stay under the package-owned ~/.bohr/tools tree; this tarball does not write foreign AI-agent config files.

Evidence against

postinstall follows HTTP redirects and uses the remote wenyon JSON url field as the download location.
Static labels treated postinstall.js and run.js as similar to blocked malware and as a runtime package installer because of the download-and-exec shape and the help string.
If a companion binary is already present, postinstall runs it with a version argument before deciding whether to replace it.

Behavioral surface

Source & flagged code

10 flagged

package.jsonView file

Lines 1-29json

2 "name": "@dptech-corp/bohr-cli",

3 "version": "2.6.56",

4 "description": "CLI tool for Bohrium scientific computing platform",

5 "bin": {

6 "bohr": "run.js"

7 },

8 "scripts": {

9 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

11 "keywords": [

12 "bohrium",

13 "scientific-computing",

14 "cli",

15 "paper-search",

16 "molecular-dynamics"

17 ],

18 "author": "DP Technology",

19 "license": "MIT",

20 "os": [

21 "darwin",

22 "linux",

23 "win32"

24 ],

25 "cpu": [

26 "x64",

27 "arm64"

28 ],

29 "files": [

postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * postinstall: downloads wenyon-cli and the trisol external edition

4 * (variant=bohrium) for the current platform.

5 * Runs after `npm install -g @dptech-corp/bohr-cli`.

6 * Failure is non-fatal — bohr-cli works without them, and `bohr extension install <tool>`

7 * can retry later.

8 */

9const https =

run.jsView file

Lines 44-84javascript

44 );

45}

47const ext = platform === "win32" ? ".exe" : "";

48const pkgName

run.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

run.js#virtual:normalized:round1View on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @dptech-corp/bohr-cli@2.6.100 matchedIdentity = npm:QGRwdGVjaC1jb3JwL2JvaHItY2xp:2.6.100 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

postinstall.js

Findings

1 Critical8 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltapostinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpostinstall.js

HighInstall Named Payload Filepostinstall.js

HighRuntime Package Installrun.js

HighSemantic Analysis Limitedrun.js#virtual:normalized:round1

HighKnown Malware Source Similaritypostinstall.js

HighKnown Malware Source Similarityrun.js

HighKnown Malware Source Fingerprint Signaturepostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @dptech-corp/bohr-cli@2.6.56.

See all versions of @dptech-corp/bohr-cli for other recorded verdicts.

Review the evidence and your use of @dptech-corp/bohr-cli@2.6.56 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 03:30:46.269Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.