registry / @dptech-corp/bohr-cli / 2.6.92
@dptech-corp/bohr-cli@2.6.92
CLI tool for Bohrium scientific computing platform
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected source establishes a real automatic lifecycle path that installs remote executable companion tools into a package-owned user-home tool store. It is not concrete malware, but it warrants a warning as first-party extension lifecycle risk.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package runs postinstall automatically.
Impact
A registry install changes the local extension tool store and introduces remote-supplied executable artifacts.
Mechanism
Remote companion-binary download and installation into a user-home tool directory.
AI rationale
The inspected source establishes a real automatic lifecycle path that installs remote executable companion tools into a package-owned user-home tool store. It is not concrete malware, but it warrants a warning as first-party extension lifecycle risk.
Evidence
package.jsonpostinstall.js~/.bohr/tools/wenyon/current~/.bohr/tools/trisol/current
Network endpoints2
wenyon.dp.techtrisol.dp.tech
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Installation automatically runs a postinstall script.
- The postinstall script contacts two remote vendor services and targets user-home tool directories.
- The script downloads remote companion binaries, makes them executable, and installs them without a separate user command.
- The downloaded companion tools are only checked against hashes supplied by the same remote services.
Evidence against
- The launcher only resolves and runs the matching optional platform package.
- The installer requires a valid SHA-256 value, rejects HTTPS-to-HTTP redirects, and skips failures.
- There is no self-dependency, credential harvesting, shell execution, or direct execution of downloaded files in the inspected JavaScript.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgrun.jsView file
1#!/usr/bin/env node
L2: const { execFileSync } = require("child_process");
L3: const path = require("path");
High
64
Findings
1 Critical5 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltapostinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processrun.js
HighRuntime Package Installrun.js
HighSemantic Analysis Limitedrun.js#virtual:normalized:round1
HighKnown Malware Source Similarityrun.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @dptech-corp/bohr-cli@2.6.92.
See all versions of @dptech-corp/bohr-cli for other recorded verdicts.
- Review the evidence and your use of @dptech-corp/bohr-cli@2.6.92 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.