registry / @dptech-corp/bohr-cli / 2.8.0
@dptech-corp/bohr-cli@2.8.0
⚠ Under reviewCLI tool for Bohrium scientific computing platform
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe inspected JavaScript shows package-aligned binary launching and hash-checked companion tool installation, without establishing an attack. The platform-specific executable source is absent from this snapshot, so its runtime behavior remains unresolved.
Static reason
One or more suspicious static signals were detected.
Trigger
Invoking the `bohr` command starts the selected platform binary; installing the package runs its postinstall hook.
Impact
The behavior of the launched platform binary remains unknown, so the package’s runtime safety cannot be determined from the inspected source.
Mechanism
The launcher resolves the matching optional package and executes its binary. The postinstall hook also downloads companion tools and installs them after hash verification.
AI rationale
The inspected JavaScript shows package-aligned binary launching and hash-checked companion tool installation, without establishing an attack. The platform-specific executable source is absent from this snapshot, so its runtime behavior remains unresolved.
Evidence
package.jsonrun.jspostinstall.js
Network endpoints2
wenyon.dp.techtrisol.dp.tech
Decision evidence
public snapshotAI called this Manual Review at 80.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest runs a postinstall script and declares platform-specific optional packages.
- The launcher resolves a platform-specific package and starts its binary when the CLI is invoked.
- The install hook downloads companion tools, checks each file against a SHA-256 hash, then makes it executable and installs it under the user’s `.bohr` directory.
- The platform binary source is not present in the inspected package snapshot, so its behavior remains unassessed.
Evidence against
- The inspected JavaScript does not show the postinstall hook launching the companion tools; it installs them for later use.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg8"scripts": {
"postinstall": "node postinstall.js"
},
"keywords": [
"bohrium",
"scientific-computing",
"cli",
"paper-sea
Low
Suspicious Lifecycle Evidence
The manifest runs a postinstall script and declares platform-specific optional packages.
package.jsonView on unpkg · L834"optionalDependencies": {
"@dptech-corp/bohr-cli-darwin-arm64": "2.8.0",
"@dptech-corp/bohr-cli-darwin-amd64": "2.8.0",
"@dptech-corp/bohr-cli-linux-amd64": "2.8.0",
"@dptech-corp/bohr-cli-linux-arm64": "2.8.0",
"@dptech-corp/bohr-cli-win
Findings
2 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedrun.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @dptech-corp/bohr-cli@2.8.0.
See all versions of @dptech-corp/bohr-cli for other recorded verdicts.
- Review the evidence and your use of @dptech-corp/bohr-cli@2.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.