registry / @dptech-corp/bohr-cli / 2.7.17

@dptech-corp/bohr-cli@2.7.17

CLI tool for Bohrium scientific computing platform

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The postinstall network and file operations serve the package’s CLI companion setup, use product-specific service endpoints and verify downloaded binaries before installation. The launcher runs the platform-specific bohr binary, and no concrete attack behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

The npm postinstall hook runs during package installation.

Impact

The inspected code installs companion executables; it does not establish harmful behavior or execute them during installation.

Mechanism

The hook retrieves release metadata and binaries from the configured companion service, verifies the downloaded file against the expected SHA-256, then installs it under ~/.bohr/tools.

AI rationale

Evidence

postinstall.jsrun.js~/.bohr/tools/wenyon/current~/.bohr/tools/trisol/current

Network endpoints2

wenyon.dp.techtrisol.dp.tech

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json describes a CLI for the Bohrium scientific computing platform and declares the postinstall hook.
run.js resolves and launches the platform-specific bohr binary from this package’s companion dependency.
postinstall.js fetches companion CLI release information from wenyon.dp.tech and stores tools under ~/.bohr/tools.
Before installation, postinstall.js compares the downloaded file’s SHA-256 with the expected hash and skips mismatches.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 37.4 KB of source, external domains: trisol.dp.tech, wenyon.dp.tech

Source & flagged code

5 flagged

package.jsonView file

Lines 1-29json

2 "name": "@dptech-corp/bohr-cli",

3 "version": "2.7.17",

4 "description": "CLI tool for Bohrium scientific computing platform",

5 "bin": {

6 "bohr": "run.js"

7 },

8 "scripts": {

9 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

11 "keywords": [

Low

Suspicious Lifecycle Evidence

package.json describes a CLI for the Bohrium scientific computing platform and declares the postinstall hook.

package.jsonView on unpkg · L8

12 "bohrium",

13 "scientific-computing",

14 "cli",

15 "paper-search",

16 "molecular-dynamics"

17 ],

18 "author": "DP Technology",

19 "license": "MIT",

20 "os": [

21 "darwin",

22 "linux",

23 "win32"

24 ],

25 "cpu": [

26 "x64",

27 "arm64"

28 ],

29 "files": [

run.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

run.js#virtual:normalized:round1View on unpkg

run.jsView file

Lines 70-110javascript

70// by pid — `timeout`, Python's Popen.terminate(), an agent framework's step

71// timeout — only ever signals this process. It used to run the binary with

72// execFileSync, which blocks the event loop, so node took the default action and

73// died on the spot while the binary kept running as an orphan, still holding the

74// caller's stdout. The caller then waited on a pipe nothing would close.

75//

76// A terminal Ctrl-C reaches both processes (same process group), so the binary

77// sees SIGINT twice. That is the usual trade-off of a forwarding launcher

78// (internal/toolproxy/exec.go makes the same one): a command without a SIGINT

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

8"scripts": { "postinstall": "node postinstall.js" }, "k

Low

Suspicious Lifecycle Evidence

package.json describes a CLI for the Bohrium scientific computing platform and declares the postinstall hook.

package.jsonView on unpkg · L8

run.js#virtual:normalized:round1View file

Findings

2 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedrun.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Dependency Evidencerun.js

Affected versions and remediation

This report applies to @dptech-corp/bohr-cli@2.7.17.

See all versions of @dptech-corp/bohr-cli for other recorded verdicts.

Review the evidence and your use of @dptech-corp/bohr-cli@2.7.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 11:22:58.956Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.