Hostile 100% javascript Download

boardflow 1.1.4

Obfuscated installer downloads and executes payload

npm preinstall hook executes an obfuscator.io-obfuscated payloadNode calls imported writeFileSync
SHA-256f925f0f80aee77f50903b2cfcd76bfb1a3ce7bca937ddaa476862910f0d774a0
URLhttps://registry.npmjs.org/boardflow/-/boardflow-1.1.4.tgz
MaleculeO₂(S₂As)H₄(DbF₄Os₂Po₃)Md(Pa₂)

Also flagged by osv (MAL-2026-5799: Malicious code in boardflow (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.