registry / @dptech-corp/bohr-cli / 2.6.9

@dptech-corp/bohr-cli@2.6.9

CLI tool for Bohrium scientific computing platform

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 2 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcess

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.99 KB of source

Source & flagged code

2 flagged

run.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { execFileSync } = require("child_process");

3const path = require("path");

High

Child Process

Package source references child process execution.

run.jsView on unpkg · L1

4const os = require("os");

6const platform = os.platform();

7const arch = os.arch();

8const archMap = { x64: "amd64", arm64: "arm64" };

9const platformMap = { darwin: "darwin", linux: "linux", win32: "windows" };

10const mappedArch = archMap[arch];

11const mappedPlatform = platformMap[platform];

13// This launcher is the only thing in the main package, so its two failure

14// exits are the first thing a caller can hit — before any Go code runs, and on

15// the very first install. Emitting bare text here left `-o json` callers with

16// nothing to branch on but English prose. Exit code 1 matches

17// PRECONDITION_FAILED's mapping in internal/envelope.

18const EXIT_PRECONDITION_FAILED = 1;

20function failPrecondition(subtype, message, hintCommand) {

21 const envelope = {

Lines 44-84javascript

44 );

45}

47const ext = platform === "win32" ? ".exe" : "";

48const pkgName = `@dptech-corp/bohr-cli-${

Source & flagged code

2 flagged · loading source

run.jsView file

1#!/usr/bin/env node L2: const { execFileSync } = require("child_process"); L3: const path = require("path");

High

Child Process

Package source references child process execution.

run.jsView on unpkg · L1

64`package managers do this without reporting an error)`, L65: "npm install -g @dptech-corp/bohr-cli --force" L66: ); ... L69: try { L70: execFileSync(binaryPath, process.argv.slice(2), { stdio: "inherit" }); L71: } catch (e) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

run.jsView on unpkg · L64

Findings

2 High

HighChild Processrun.js

HighRuntime Package Installrun.js

Affected versions and remediation

This report applies to @dptech-corp/bohr-cli@2.6.9.

See all versions of @dptech-corp/bohr-cli for other recorded verdicts.

Review the evidence and your use of @dptech-corp/bohr-cli@2.6.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-12 04:45:42.613Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.