registry / @dptech-corp/bohr-cli / 2.6.61

@dptech-corp/bohr-cli@2.6.61

CLI tool for Bohrium scientific computing platform

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package automatically delivers executable payloads during installation, creating a supply-chain risk. Its writes are package-owned and the inspected source does not establish malicious collection, persistence outside that area, or control-surface hijacking.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation of this package triggers postinstall.

Impact

A compromised or redirected vendor delivery path could place executable code in the user's .bohr tool directory.

Mechanism

Postinstall remote binary download and executable installation.

AI rationale

Evidence

package.jsonpostinstall.js~/.bohr/tools/trisol/current/trisol~/.bohr/tools/trisol/manifest.yaml~/.bohr/tools/wenyon/current/wenyon-cli~/.bohr/tools/wenyon/manifest.yaml

Network endpoints2

wenyon.dp.techtrisol.dp.tech

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The install lifecycle runs postinstall.js automatically.
The lifecycle fetches release metadata and binaries from vendor endpoints, with redirects followed.
Downloaded companion executables are made executable and placed under the package-owned .bohr tool directory.
The trisol server can be overridden through an environment variable.

Evidence against

The inspected JavaScript does not harvest credentials, environment values, or unrelated files.
No self-dependency, shell command construction, eval, or broad project configuration write is present.
The launcher only resolves and executes the matching platform package when the user invokes bohr.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 13.9 KB of source, external domains: trisol.dp.tech, wenyon.dp.tech

Source & flagged code

10 flagged

package.jsonView file

Lines 1-29json

2 "name": "@dptech-corp/bohr-cli",

3 "version": "2.6.61",

4 "description": "CLI tool for Bohrium scientific computing platform",

5 "bin": {

6 "bohr": "run.js"

7 },

8 "scripts": {

9 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

11 "keywords": [

12 "bohrium",

13 "scientific-computing",

14 "cli",

15 "paper-search",

16 "molecular-dynamics"

17 ],

18 "author": "DP Technology",

19 "license": "MIT",

20 "os": [

21 "darwin",

22 "linux",

23 "win32"

24 ],

25 "cpu": [

26 "x64",

27 "arm64"

28 ],

29 "files": [

postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * postinstall: downloads wenyon-cli and the trisol external edition

4 * (variant=bohrium) for the current platform.

5 * Runs after `npm install -g @dptech-corp/bohr-cli`.

6 * Failure is non-fatal — bohr-cli works without them, and `bohr extension install <tool>`

7 * can retry later.

8 */

9const https =

run.jsView file

Lines 44-84javascript

44 );

45}

47const ext = platform === "win32" ? ".exe" : "";

48const pkgName

run.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

run.js#virtual:normalized:round1View on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @dptech-corp/bohr-cli@2.6.100 matchedIdentity = npm:QGRwdGVjaC1jb3JwL2JvaHItY2xp:2.6.100 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

postinstall.js

Findings

1 Critical8 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltapostinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpostinstall.js

HighInstall Named Payload Filepostinstall.js

HighRuntime Package Installrun.js

HighSemantic Analysis Limitedrun.js#virtual:normalized:round1

HighKnown Malware Source Similaritypostinstall.js

HighKnown Malware Source Similarityrun.js

HighKnown Malware Source Fingerprint Signaturepostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @dptech-corp/bohr-cli@2.6.61.

See all versions of @dptech-corp/bohr-cli for other recorded verdicts.

Review the evidence and your use of @dptech-corp/bohr-cli@2.6.61 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 08:43:43.417Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.