Hostile 100% javascript Download

boardflow 1.1.8

Obfuscated install script downloads and executes payload

npm preinstall hook executes an obfuscator.io-obfuscated payloadNode calls imported writeFileSync
SHA-2568fa467f3b1296eac7ecb61dffe43c114fad4d6a4aadd9eb330ae1ea3452df108
URLhttps://registry.npmjs.org/boardflow/-/boardflow-1.1.8.tgz
MaleculeO₂(S₂As)H₄(DbF₄Os₂Po₃)Md(Pa₂)

Also flagged by osv (MAL-2026-5799: Malicious code in boardflow (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.