registry / @dptech-corp/bohr-cli / 2.7.18

@dptech-corp/bohr-cli@2.7.18

CLI tool for Bohrium scientific computing platform

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The lifecycle hook performs package-related companion tool setup and checks downloaded files against expected SHA256 values before installing them. The CLI launcher forwards caller arguments to the platform-specific Bohr binary; inspected source establishes no attack behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

npm runs the postinstall hook during installation; a user or caller invokes the bohr command to start its platform binary.

Impact

The source shows product setup and command execution, with no confirmed malicious behavior.

Mechanism

The hook downloads companion tools from Bohr service endpoints, checks their SHA256 values, and installs them under the user's .bohr tools directory.

AI rationale

Evidence

package.jsonpostinstall.jsrun.js~/.bohr/tools/wenyon~/.bohr/tools/trisol

Network endpoints2

wenyon.dp.techtrisol.dp.tech

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines a postinstall hook that runs postinstall.js.
run.js launches the platform-specific Bohr binary with the caller's arguments.
postinstall.js downloads companion tools from the package's Bohr service endpoints into ~/.bohr/tools.
The installer compares the downloaded file's SHA256 with the expected hash before making it executable.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 37.4 KB of source, external domains: trisol.dp.tech, wenyon.dp.tech

Source & flagged code

5 flagged

package.jsonView file

Lines 1-29json

2 "name": "@dptech-corp/bohr-cli",

3 "version": "2.7.18",

4 "description": "CLI tool for Bohrium scientific computing platform",

5 "bin": {

6 "bohr": "run.js"

7 },

8 "scripts": {

9 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

11 "keywords": [

12 "bohrium",

13 "scientific-computing",

Low

Suspicious Lifecycle Evidence

package.json defines a postinstall hook that runs postinstall.js.

package.jsonView on unpkg · L9

14 "cli",

15 "paper-search",

16 "molecular-dynamics"

17 ],

18 "author": "DP Technology",

19 "license": "MIT",

20 "os": [

21 "darwin",

22 "linux",

23 "win32"

24 ],

25 "cpu": [

26 "x64",

27 "arm64"

28 ],

29 "files": [

run.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

run.js#virtual:normalized:round1View on unpkg

run.jsView file

Lines 70-110javascript

70// by pid — `timeout`, Python's Popen.terminate(), an agent framework's step

71// timeout — only ever signals this process. It used to run the binary with

72// execFileSync, which blocks the event loop, so node took the default action and

73// died on the spot while the binary kept running as an orphan, still holding the

74// caller's stdout. The caller then waited on a pipe nothing would close.

75//

76// A terminal Ctrl-C reaches both processes (same process group), so the binary

77// sees SIGINT twice. That is the usual trade-off of a forwarding launcher

78// (internal/toolproxy/exec.go makes the same one): a command without a SIGINT

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

9"postinstall": "node postinstall.js" }, "keywords": [ "bohrium", "sc

Low

Suspicious Lifecycle Evidence

package.json defines a postinstall hook that runs postinstall.js.

package.jsonView on unpkg · L9

run.js#virtual:normalized:round1View file

Findings

2 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedrun.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencerun.js

Affected versions and remediation

This report applies to @dptech-corp/bohr-cli@2.7.18.

See all versions of @dptech-corp/bohr-cli for other recorded verdicts.

Review the evidence and your use of @dptech-corp/bohr-cli@2.7.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 11:26:37.024Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.