registry / @dptech-corp/bohr-cli / 2.6.57

@dptech-corp/bohr-cli@2.6.57

CLI tool for Bohrium scientific computing platform

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Source shows a first-party CLI: postinstall fetches hashed companion tools from dp.tech into ~/.bohr/tools, and run.js launches the matching optional platform binary. Scanner malware-similarity and runtime-install labels come from that installer pattern and an error hint, not a hidden attack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install runs postinstall.js; later use of the bohr command runs run.js.

Impact

No confirmed secret theft, foreign agent-config writes, or other malicious side effects.

Mechanism

Vendor companion-tool download plus platform binary launch

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

postinstall.js runs on npm install and downloads companion binaries into the user home directory.
run.js is the bohr launcher and executes a native binary from an optional platform package.
package.json declares a postinstall lifecycle script.

Evidence against

Downloads use vendor hosts wenyon.dp.tech and trisol.dp.tech, check SHA-256, and write only under ~/.bohr/tools.
run.js resolves same-version @dptech-corp/bohr-cli platform packages; the npm install string is an error hint, not a runtime installer.
No credential harvest, eval, agent-config writes, obfuscation, or a runtime self-dependency on this package name.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 13.9 KB of source, external domains: trisol.dp.tech, wenyon.dp.tech

Source & flagged code

10 flagged

package.jsonView file

Lines 1-29json

2 "name": "@dptech-corp/bohr-cli",

3 "version": "2.6.57",

4 "description": "CLI tool for Bohrium scientific computing platform",

5 "bin": {

6 "bohr": "run.js"

7 },

8 "scripts": {

9 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

11 "keywords": [

12 "bohrium",

13 "scientific-computing",

14 "cli",

15 "paper-search",

16 "molecular-dynamics"

17 ],

18 "author": "DP Technology",

19 "license": "MIT",

20 "os": [

21 "darwin",

22 "linux",

23 "win32"

24 ],

25 "cpu": [

26 "x64",

27 "arm64"

28 ],

29 "files": [

postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * postinstall: downloads wenyon-cli and the trisol external edition

4 * (variant=bohrium) for the current platform.

5 * Runs after `npm install -g @dptech-corp/bohr-cli`.

6 * Failure is non-fatal — bohr-cli works without them, and `bohr extension install <tool>`

7 * can retry later.

8 */

9const https =

run.jsView file

Lines 44-84javascript

44 );

45}

47const ext = platform === "win32" ? ".exe" : "";

48const pkgName

run.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

run.js#virtual:normalized:round1View on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @dptech-corp/bohr-cli@2.6.100 matchedIdentity = npm:QGRwdGVjaC1jb3JwL2JvaHItY2xp:2.6.100 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

postinstall.js

Findings

1 Critical8 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltapostinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpostinstall.js

HighInstall Named Payload Filepostinstall.js

HighRuntime Package Installrun.js

HighSemantic Analysis Limitedrun.js#virtual:normalized:round1

HighKnown Malware Source Similaritypostinstall.js

HighKnown Malware Source Similarityrun.js

HighKnown Malware Source Fingerprint Signaturepostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @dptech-corp/bohr-cli@2.6.57.

See all versions of @dptech-corp/bohr-cli for other recorded verdicts.

Review the evidence and your use of @dptech-corp/bohr-cli@2.6.57 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 21:26:59.603Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.