registry / @dptech-corp/bohr-cli / 2.7.16

@dptech-corp/bohr-cli@2.7.16

CLI tool for Bohrium scientific computing platform

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Source inspection found an automatic companion-tool installer and a platform binary launcher, with downloads tied to the Bohr endpoints and checked against release SHA-256 values. No concrete attack behavior was established.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the npm package triggers postinstall; invoking bohr runs the platform-specific package binary.

Impact

This performs expected companion-tool setup and launches the requested CLI; no credential collection, unrelated data transfer, or malicious behavior was established.

Mechanism

The installer downloads release metadata and binaries, checks the downloaded file against the provided SHA-256 value, then installs it. The launcher forwards arguments to the resolved binary.

AI rationale

Evidence

postinstall.jsrun.jspackage.json

Network endpoints2

trisol.dp.techwenyon.dp.tech

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest’s postinstall runs the package’s companion-tool installer.
The installer fetches companion releases from the named Bohr service endpoints and places tools under the user’s .bohr/tools directory.
Downloaded tools are checked against a SHA-256 value before being made executable and installed.
The launcher resolves the platform binary and forwards caller arguments to it.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 37.4 KB of source, external domains: trisol.dp.tech, wenyon.dp.tech

Source & flagged code

5 flagged

package.jsonView file

Lines 1-29json

2 "name": "@dptech-corp/bohr-cli",

3 "version": "2.7.16",

4 "description": "CLI tool for Bohrium scientific computing platform",

5 "bin": {

6 "bohr": "run.js"

7 },

8 "scripts": {

9 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

11 "keywords": [

12 "bohrium",

13 "scientific-computing",

Low

Suspicious Lifecycle Evidence

The manifest’s postinstall runs the package’s companion-tool installer.

package.jsonView on unpkg · L9

14 "cli",

15 "paper-search",

16 "molecular-dynamics"

17 ],

18 "author": "DP Technology",

19 "license": "MIT",

20 "os": [

21 "darwin",

22 "linux",

23 "win32"

24 ],

25 "cpu": [

26 "x64",

27 "arm64"

28 ],

29 "files": [

run.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

run.js#virtual:normalized:round1View on unpkg

run.jsView file

Lines 70-110javascript

70// by pid — `timeout`, Python's Popen.terminate(), an agent framework's step

71// timeout — only ever signals this process. It used to run the binary with

72// execFileSync, which blocks the event loop, so node took the default action and

73// died on the spot while the binary kept running as an orphan, still holding the

74// caller's stdout. The caller then waited on a pipe nothing would close.

75//

76// A terminal Ctrl-C reaches both processes (same process group), so the binary

77// sees SIGINT twice. That is the usual trade-off of a forwarding launcher

78// (internal/toolproxy/exec.go makes the same one): a command without a SIGINT

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

9"postinstall": "node postinstall.js" }, "keywords": [ "bohrium", "scientific-computing",

Low

Suspicious Lifecycle Evidence

The manifest’s postinstall runs the package’s companion-tool installer.

package.jsonView on unpkg · L9

run.js#virtual:normalized:round1View file

Findings

2 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedrun.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencerun.js

Affected versions and remediation

This report applies to @dptech-corp/bohr-cli@2.7.16.

See all versions of @dptech-corp/bohr-cli for other recorded verdicts.

Review the evidence and your use of @dptech-corp/bohr-cli@2.7.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 12:27:55.523Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.