registry / @dptech-corp/bohr-cli / 2.7.24

@dptech-corp/bohr-cli@2.7.24

CLI tool for Bohrium scientific computing platform

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The flagged lifecycle and network behavior implements companion-tool setup for this CLI: the inspected sources identify vendor endpoints and verify downloaded executable hashes before installation. The launcher starts the platform binary with the caller’s arguments, and no concrete attack behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package runs its postinstall hook; invoking the CLI starts the platform-specific binary with the caller’s arguments.

Impact

The hook performs network and user-directory changes, but the inspected source does not establish credential collection, unrelated data transfer, or execution of the downloaded tools during installation.

Mechanism

The hook requests release information from the vendor services, downloads the offered tools, checks their hashes, and stores them under .bohr/tools for later use.

AI rationale

Evidence

package.jsonpostinstall.jsrun.js

Network endpoints2

trisol.dp.techwenyon.dp.tech

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines the CLI entry point and a postinstall hook that runs postinstall.js.
The launcher starts the selected platform binary and forwards the caller’s arguments.
The installer uses the vendor’s trisol and wenyon services and places companion tools in the user’s .bohr tools directory.
The postinstall flow fetches release metadata and passes the offered download URL and hash to the installer.
The installer compares the downloaded file’s SHA-256 value with the expected value before making it executable and installing it.
The hook runs the installer as its main-module entry point; the launcher starts the platform package binary.

Evidence against

The postinstall hook automatically downloads and installs companion executables, so it performs network and filesystem changes during installation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

5 flagged

package.jsonView file

Lines 1-29json

2 "name": "@dptech-corp/bohr-cli",

3 "version": "2.7.24",

4 "description": "CLI tool for Bohrium scientific computing platform",

5 "bin": {

6 "bohr": "run.js"

7 },

8 "scripts": {

9 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

11 "keywords": [

12 "bohrium",

13 "scientific-computing",

Low

Suspicious Lifecycle Evidence

The manifest defines the CLI entry point and a postinstall hook that runs postinstall.js.

package.jsonView on unpkg · L5

14 "cli",

15 "paper-search",

16 "molecular-dynamics"

17 ],

18 "author": "DP Technology",

19 "license": "MIT",

20 "os": [

21 "darwin",

22 "linux",

23 "win32"

24 ],

25 "cpu": [

26 "x64",

27 "arm64"

28 ],

29 "files": [

run.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

run.js#virtual:normalized:round1View on unpkg

run.jsView file

Lines 68-108javascript

69// Signals sent to this launcher must reach the binary. A caller that stops bohr

70// by pid — `timeout`, Python's Popen.terminate(), an agent framework's step

71// timeout — only ever signals this process. It used to run the binary with

72// execFileSync, which blocks the event loop, so node took the default action and

73// died on the spot while the binary kept running as an orphan, still holding the

74// caller's stdout. The caller then waited on a pipe nothing would close.

75//

76// A terminal Ctrl-C reaches both processes (same process group), so the binary

77// sees SIGINT twice. That is the usual trade-off of a forwarding launcher

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

5"bin": { "bohr": "run.js" }, "scripts": { "postinstall": "node postinstall.js" }, "keywords": [ "bohrium", "scientific-

Low

Suspicious Lifecycle Evidence

The manifest defines the CLI entry point and a postinstall hook that runs postinstall.js.

package.jsonView on unpkg · L5

run.js#virtual:normalized:round1View file

Findings

2 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedrun.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencerun.js

Affected versions and remediation

This report applies to @dptech-corp/bohr-cli@2.7.24.

See all versions of @dptech-corp/bohr-cli for other recorded verdicts.

Review the evidence and your use of @dptech-corp/bohr-cli@2.7.24 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 11:57:59.966Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.